keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2018:2428 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2019:0877 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10912 | Issue Tracking Vendor Advisory |
Configurations
History
22 Apr 2021, 00:12
Type | Values Removed | Values Added |
---|---|---|
References | (REDHAT) https://access.redhat.com/errata/RHSA-2018:2428 - Vendor Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:0877 - Vendor Advisory | |
References | (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10912 - Issue Tracking, Vendor Advisory | |
CPE | cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* |
Information
Published : 2018-07-23 22:29
Updated : 2023-12-10 12:44
NVD link : CVE-2018-10912
Mitre link : CVE-2018-10912
CVE.ORG link : CVE-2018-10912
JSON object : View
Products Affected
redhat
- single_sign-on
- keycloak
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')