An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
CVE-2023-6563 - High Severity Vulnerability
Keycloak SSO
Library home page: http://keycloak.org
Path to dependency file: /pom.xml
Path to vulnerable library: /20201127105057_JYADOJ/downloadResource_XKWWQX/20201127110004/keycloak-model-jpa-8.0.0.jar
Dependency Hierarchy: - :x: **keycloak-model-jpa-8.0.0.jar** (Vulnerable Library)
Found in HEAD commit: 26994796809a3a8687a975e3361495d457afe47c
Found in base branch: master
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
Publish Date: 2023-12-14
URL: CVE-2023-6563
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2023-12-14
Fix Resolution: 21.0.0
Step up your Open Source Security Game with Mend here