PT-2023-32694 · Red Hat · Keycloak
Nick Tait
·
Publicado
2023-12-14
·
Atualizado
2023-12-27
·
CVE-2023-6563
CVSS v3.1
7.7
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Keycloak (affected versions not specified)
Description
An unconstrained memory consumption issue was discovered. It can be triggered in environments with millions of offline tokens, specifically when there are more than 500,000 users, each having at least 2 saved sessions. If an attacker creates two or more user sessions and then opens the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions. This leads to excessive memory and CPU consumption, which could potentially crash the entire system.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Keycloak