Описание
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | keycloak | Not affected | ||
| Red Hat Mobile Application Platform 4 | keycloak | Not affected | ||
| Red Hat OpenShift Application Runtimes | keycloak | Affected | ||
| Red Hat Single Sign-On 7 | rh-sso7-keycloak | Affected | ||
| Red Hat Single Sign-On 7.2.4 zip | Fixed | RHSA-2018:2428 | 15.08.2018 | |
| Text-Only RHOAR | Fixed | RHSA-2019:0877 | 24.04.2019 |
Показывать по
Дополнительная информация
Статус:
4.4 Medium
CVSS3
Связанные уязвимости
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
keycloak before version 4.0.0.final is vulnerable to a infinite loop i ...
Moderate severity vulnerability that affects org.keycloak:keycloak-core
4.4 Medium
CVSS3