PT-2023-32694 · Red Hat · Keycloak

Nick Tait · Published 2023-12-14 · Updated 2023-12-27 · CVE-2023-6563

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An unconstrained memory consumption issue was discovered. It can be triggered in environments with millions of offline tokens, specifically when there are more than 500,000 users, each having at least 2 saved sessions. If an attacker creates two or more user sessions and then opens the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions. This leads to excessive memory and CPU consumption, which could potentially crash the entire system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2023-6563

GHSA-54F3-C6HG-865H

RHSA-2023:7854

RHSA-2023:7855

RHSA-2023:7856

Affected Products

Keycloak

References · 17

• 🔥 https://access.redhat.com/errata/RHSA-2023:7857 · Exploit
• https://access.redhat.com/security/cve/CVE-2023-6563 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54f3-c6hg-865h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6563 · Security Note
• https://access.redhat.com/errata/RHSA-2023:7854 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7856 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7858 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7855 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6563 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/13340 · Note
• https://github.com/keycloak/keycloak/commit/556146f961f7c8ddf64de15e2117a58d045f72b5 · Note
• https://github.com/keycloak/keycloak/pull/15463 · Note
• https://twitter.com/VulmonFeeds/status/1735379896312992233 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2253308 · Note