Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Red Hat Single Sign-On ist ein eigenständiger Server, basierend auf dem Keycloak Projekt.
Vulnerabilities 2
-
High 7.7
Keycloak: offline session token dos
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessi…
-
High 7.1
Keycloak: redirect_uri validation bypass
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other user…
Revision history
-
#3
Neue Updates von HITACHI aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Security Advisory RHSA-2024:0799 vom 2024-02-14
https://access.redhat.com/errata/RHSA-2024:0799
-
Red Hat Security Advisory RHSA-2024:0804 vom 2024-02-13
https://access.redhat.com/errata/RHSA-2024:0804
-
RedHat Security Advisory vom 2023-12-14
https://access.redhat.com/errata/RHSA-2023:7854
-
RedHat Security Advisory vom 2023-12-14
https://access.redhat.com/errata/RHSA-2023:7855
-
RedHat Security Advisory vom 2023-12-14
https://access.redhat.com/errata/RHSA-2023:7856
-
RedHat Security Advisory vom 2023-12-14
https://access.redhat.com/errata/RHSA-2023:7857
-
RedHat Security Advisory vom 2023-12-14
https://access.redhat.com/errata/RHSA-2023:7858
-
RedHat Security Advisory vom 2023-12-14
https://access.redhat.com/errata/RHSA-2023:7860
-
RedHat Security Advisory vom 2023-12-14
https://access.redhat.com/errata/RHSA-2023:7861
-
Hitachi Vulnerability Information HITACHI-SEC-2024-133 vom 2024-07-02
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-133/index.html