CVE-2023-6563 — Keycloak: offline session token dos

Description (CNA)

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7	unaffected 0:18.0.11-2.redhat_00003.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8	unaffected 0:18.0.11-2.redhat_00003.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9	unaffected 0:18.0.11-2.redhat_00003.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containers	unaffected 7.6-38 before *
Red Hat / RHEL-8 based Middleware Containers	unaffected 7.6.6-2 before *
Red Hat / Single Sign-On 7.6.6	unaffected
Red Hat / Red Hat Build of Keycloak	unaffected

CWE

CWE-770

References

ADP enrichment

CVE

No English description supplied.