PT-2018-7155 · Red Hat · Keycloak

Chess Hazlett · Publicado 2018-07-27 · Atualizado 2019-10-09 · CVE-2017-2646

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 2.5.5

Description: The issue arises when a Logout request with Extensions in the middle of the request is received, causing the SAMLSloRequestParser.parse() method to enter an infinite loop. This can be exploited by an attacker to conduct denial of service attacks.

Recommendations: For versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue. As a temporary workaround, consider restricting or validating the input for the Logout request to prevent the infinite loop in the SAMLSloRequestParser.parse() method.

Correção

DoS

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2017-2646

GHSA-JC6Q-27MW-P55W

Produtos afetados

Keycloak

Referências · 7

• https://github.com/keycloak/keycloak · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2646 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2646 · Nota
• https://github.com/advisories/GHSA-jc6q-27mw-p55w · Nota
• https://osv.dev/vulnerability/GHSA-jc6q-27mw-p55w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2646 · Aviso do Fabricante
• http://securityfocus.com/bid/96882 · Nota