PT-2018-10178 · Red Hat · Keycloak

Chess Hazlett · Published 2018-07-23 · Updated 2021-04-22 · CVE-2018-10912

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 4.0.0.final

Description The issue is related to an infinite loop in session replacement. In a Keycloak cluster with multiple nodes, an expired session replacement could be mishandled, leading to an infinite loop. A malicious authenticated user could exploit this to achieve Denial of Service on the server.

Recommendations For versions prior to 4.0.0.final, update to version 4.0.0.final or later to resolve the issue.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2018-10912

GHSA-H7J7-PW3V-3V3X

Affected Products

Keycloak

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-10912 · Security Note
• https://osv.dev/vulnerability/GHSA-h7j7-pw3v-3v3x · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2428 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0877 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10912 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10912 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/advisories/GHSA-h7j7-pw3v-3v3x · Note