VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
249bc4cebedade5155d8eeefbac7a00eae5d85bc
vuln-cve/data/2023/6xxx/CVE-2023-6563.json
T

344 lines
14 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2023-6563",
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"state": "PUBLISHED",
"assignerShortName": "redhat",
"dateReserved": "2023-12-06T18:47:35.594Z",
"datePublished": "2023-12-14T18:01:26.005Z",
"dateUpdated": "2026-09-22T03:27:59.665Z"
},
"containers": {
"cna": {
"title": "Keycloak: offline session token dos",
"metrics": [
{
"other": {
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"descriptions": [
{
"lang": "en",
"value": "An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the \"consents\" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"defaultStatus": "affected",
"versions": [
{
"version": "0:18.0.11-2.redhat_00003.1.el7sso",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"defaultStatus": "affected",
"versions": [
{
"version": "0:18.0.11-2.redhat_00003.1.el8sso",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"defaultStatus": "affected",
"versions": [
{
"version": "0:18.0.11-2.redhat_00003.1.el9sso",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
]
},
{
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rh-sso-7/sso76-openshift-rhel8",
"defaultStatus": "affected",
"versions": [
{
"version": "7.6-38",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
]
},
{
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rh-sso-7/sso7-rhel8-operator-bundle",
"defaultStatus": "affected",
"versions": [
{
"version": "7.6.6-2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
]
},
{
"vendor": "Red Hat",
"product": "Single Sign-On 7.6.6",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"defaultStatus": "unaffected",
"packageName": "rh-sso7-keycloak",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-core",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2023:7854",
"name": "RHSA-2023:7854",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7855",
"name": "RHSA-2023:7855",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7856",
"name": "RHSA-2023:7856",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7857",
"name": "RHSA-2023:7857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7858",
"name": "RHSA-2023:7858",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-6563",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253308",
"name": "RHBZ#2253308",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
},
{
"url": "https://github.com/keycloak/keycloak/issues/13340"
}
],
"datePublic": "2023-12-14T00:00:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling",
"workarounds": [
{
"lang": "en",
"value": "There are three main options to prevent exploitation:\n1) If you are using a reverse proxy, block the consents URL.\n2) This option is less effective: remove the consents application tab from the account console theme.\n3) This option has a significant negative impact on end users: entirely disable offline user profiles."
}
],
"timeline": [
{
"lang": "en",
"time": "2023-12-06T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2023-12-14T00:00:00.000Z",
"value": "Made public."
}
],
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-09-22T03:27:59.665Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
}
},
"adp": [
{
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2024-08-02T08:35:14.663Z"
},
"title": "CVE Program Container",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2023:7854",
"name": "RHSA-2023:7854",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7855",
"name": "RHSA-2023:7855",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7856",
"name": "RHSA-2023:7856",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7857",
"name": "RHSA-2023:7857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:7858",
"name": "RHSA-2023:7858",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-6563",
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253308",
"name": "RHBZ#2253308",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
]
},
{
"url": "https://github.com/keycloak/keycloak/issues/13340",
"tags": [
"x_transferred"
]
}
]
}
]
}
}
View Git Blame Copy Permalink