2 lines
12 KiB
JSON
2 lines
12 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2.15-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2-18","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2-18","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"unaffected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.2.15","vendor":"Red Hat"},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4.11-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-14","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-14","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"unaffected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.4.11","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7.6.13","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 7","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el7sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el8sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el9sso","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhosemc:1.0::el8"],"defaultStatus":"affected","packageName":"rh-sso-7/sso76-openshift-rhel8","product":"RHEL-8 based Middleware Containers","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"7.6-85","versionType":"rpm"}]}],"source":"secalert@redhat.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2.15-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2-18","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2-18","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"],"defaultStatus":"unaffected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.2.15","vendor":"Red Hat"},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4.11-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-14","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-14","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"unaffected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.4.11","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*","matchCriteriaId":"1830E455-7E11-4264-862D-05971A42D4A6","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:build_of_keycloak:26.2:*:*:*:text-only:*:*:*","matchCriteriaId":"C339EBE3-6BFD-4082-B904-4E8DB87AAE68","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:build_of_keycloak:26.2.15:*:*:*:text-only:*:*:*","matchCriteriaId":"3BDF8A92-727E-401B-80BB-A141DCB39750","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:build_of_keycloak:26.4:*:*:*:text-only:*:*:*","matchCriteriaId":"100AA077-7467-4F62-A8FD-88BC336972DF","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:build_of_keycloak:26.4.11:*:*:*:text-only:*:*:*","matchCriteriaId":"17E79930-BE1C-4901-AF63-36B3EB149AFC","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server."},{"lang":"es","value":"Se encontró un defecto en Keycloak. Un atacante no autenticado puede explotar esta vulnerabilidad enviando una solicitud POST especialmente diseñada con un parámetro ’scope’ excesivamente largo al endpoint de token de OpenID Connect (OIDC). Esto conduce a un alto consumo de recursos y tiempos de procesamiento prolongados, lo que finalmente resulta en una denegación de servicio (DoS) para el servidor Keycloak."}],"id":"CVE-2026-4634","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4634","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-03T17:22:51.847497Z","version":"2.0.3"}}]},"published":"2026-04-02T13:16:27.027","references":[{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6475"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6476"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6477"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6478"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76128"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76129"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76130"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76132"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76134"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-4634"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450250"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6475"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6476"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6477"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:6478"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-4634"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450250"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4634.json"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-1050"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-1050"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
|