PT-2018-10178 · Red Hat · Keycloak

Chess Hazlett · Publicado 2018-07-23 · Atualizado 2021-04-22 · CVE-2018-10912

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 4.0.0.final

Description The issue is related to an infinite loop in session replacement. In a Keycloak cluster with multiple nodes, an expired session replacement could be mishandled, leading to an infinite loop. A malicious authenticated user could exploit this to achieve Denial of Service on the server.

Recommendations For versions prior to 4.0.0.final, update to version 4.0.0.final or later to resolve the issue.

Correção

DoS

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2018-10912

GHSA-H7J7-PW3V-3V3X

Produtos afetados

Keycloak

Referências · 8

• https://github.com/keycloak/keycloak · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10912 · Nota de Segurança
• https://github.com/advisories/GHSA-h7j7-pw3v-3v3x · Nota
• https://osv.dev/vulnerability/GHSA-h7j7-pw3v-3v3x · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2428 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:0877 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-10912 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10912 · Aviso do Fabricante