Log in Start free

Vulnerability · Published Dec 14, 2023 · Assigned by redhat

CVE-2023-6563Keycloak: offline session token dos

High 7.7

In plain English

A high-severity resource allocation without limits in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)1.2%top 30.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-model-jpa21.0.0GHSA-54f3-c6hg-865h

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat Single Sign-On 7.6.6 see references
Red Hat Red Hat Build of Keycloak see references

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

References