GitHub Advisoryadvisory · Maven

GHSA-jc6q-27mw-p55w Keycloak vulnerable to infinite loop based Denial of Service

HIGH Published 2018-10-18 Modified 2022-09-13 Official page ↗
Aliases
CVE-2017-2646
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2020-06-16

Affected packages

• Maven org.keycloak:keycloak-core: < 2.5.5 → fixed in 2.5.5

Description

When Keycloak versions prior to 2.5.5 receive a Logout request with an Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in an infinite loop. An attacker could use this flaw to conduct denial of service attacks.

Related

Alias · CVE (1)

  • CVE-2017-2646 It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References