PT-2021-21255 · Red Hat · Keycloak

Paramvir Jindal · Published 2021-07-09 · Updated 2021-07-13 · CVE-2021-3637

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions keycloak versions prior to 14.0.0

Description A flaw was found in keycloak-model-infinispan where the authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly, which could lead to a Denial of Service (DoS) attack.

Recommendations For versions prior to 14.0.0, update to version 14.0.0 or later to resolve the issue.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2021-3637

GHSA-2VP8-JV5V-6QH6

RHSA-2021:3527

RHSA-2021:3528

RHSA-2021:3529

Affected Products

Keycloak

References · 5

• https://bugzilla.redhat.com/show_bug.cgi?id=1979638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3637 · Security Note
• https://osv.dev/vulnerability/GHSA-2vp8-jv5v-6qh6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3637 · Vendor Advisory
• https://t.me/cvenotify/17331 · Telegram Post