PT-2024-15105 · Red Hat · Keycloak

Rohit Keshri · Published 2024-09-10 · Updated 2024-10-01 · CVE-2023-6841

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 24

Description A denial of service issue was found in Keycloak where the amount of attributes per object is not limited. An attacker could cause resource exhaustion by sending repeated HTTP requests, leading to the application sending back rows with long attribute values.

Recommendations For versions prior to 24, update to Keycloak 24 or later, which introduces the User Profile feature that fixes this issue. As a temporary workaround, consider restricting the amount of attributes per object to prevent resource exhaustion.

Fix

DoS

Weakness Enumeration

CWE-231

Related Identifiers

CVE-2023-6841

GHSA-W97F-W3HQ-36G2

Affected Products

Keycloak

References · 11

• https://access.redhat.com/security/cve/CVE-2023-6841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6841 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6841 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2254714 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w97f-w3hq-36g2 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/releases/tag/24.0.0 · Note
• https://github.com/keycloak/keycloak/issues/32837 · Note
• https://twitter.com/CVEnew/status/1833549059019444515 · Twitter Post
• https://t.me/cvenotify/95660 · Telegram Post
• https://twitter.com/oktsec/status/1833584783776968798 · Twitter Post