CVE-2017-2646 - keycloak: DoS via SAML request

Back Back to CVE browser

HIGH

keycloak: DoS via SAML request

Published Jul 27, 2018

7.5

HIGH

CVSS 3.0

EPSS 1.83%

Description

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.

Affected products

Vendor Red Hat Product Keycloak Default
n/a
- Version
  2.5.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Red Hat

Keycloak

n/a

Version	Status	Constraints
2.5.5	affected	-

Product	Package	State	Advisory
Red Hat Single Sign-On 7	rh-sso7-keycloak	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-835

References (7)

http://www.securityfocus.com/bid/96882
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-2646
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1431230
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2646
x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-jc6q-27mw-p55w
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-2646
https://www.cve.org/CVERecord?id=CVE-2017-2646

Link	Providers	Tags
http://www.securityfocus.com/bid/96882		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-2646		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1431230		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2646		x_refsource_CONFIRMIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-jc6q-27mw-p55w		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-2646
https://www.cve.org/CVERecord?id=CVE-2017-2646