7.7

CVE-2023-6563

Exploit

Keycloak: offline session token dos

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Keycloak Version < 21.0.0
Redhat ≫ Single Sign-on Version 7.6
   Redhat ≫ Enterprise Linux Version 7.0
   Redhat ≫ Enterprise Linux Version 8.0
   Redhat ≫ Enterprise Linux Version 9.0
Redhat ≫ Single Sign-on Version - SwEdition text-only
Redhat ≫ Openshift Container Platform Version 4.11
   Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Openshift Container Platform Version 4.12
   Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Openshift Container Platform For Power Version 4.10
   Redhat ≫ Enterprise Linux Version 8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.24% 0.653
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
RedHat 7.7 3.1 4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://bugzilla.redhat.com/show_bug.cgi?id=2253308
Issue Tracking
https://github.com/keycloak/keycloak/issues/13340
Issue Tracking
https://access.redhat.com/errata/RHSA-2023:7854
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7855
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7856
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7857
Exploit
https://access.redhat.com/errata/RHSA-2023:7858
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-6563
Vendor Advisory