GitHub Advisoryadvisory · Maven

GHSA-2vp8-jv5v-6qh6 Allocation of resources without limits or throttling in keycloak-model-infinispan

HIGH Published 2021-07-13 Modified 2021-07-14 Official page ↗
Aliases
CVE-2021-3637
Ecosystem
Maven
Packages
org.keycloak:keycloak-model-infinispan
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2021-07-13

Affected packages

• Maven org.keycloak:keycloak-model-infinispan: < 14.0.0 → fixed in 14.0.0

Description

A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.

Related

Alias · CVE (1)

  • CVE-2021-3637 A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References