Red Hat Keycloak CVE-2023-6841 DoS Vulnerability Advisory

Key Information Vulnerability Description CVE Number: CVE-2023-6841 Public Disclosure Date: September 10, 2023 Last Modified Date: September 10, 2023 Severity: Medium Description: A denial-of-service vulnerability has been discovered in Keycloak. When the number of object attributes is unrestricted, an attacker can send repeated HTTP requests, potentially exhausting resources, especially when the application sends lines with long attribute values. Affected Products and Red Hat Security Patches Red Hat build of Quarkus Red Hat JBoss Fuse 7 Red Hat Mobile Application Platform 4 Red Hat OpenShift Application Runtimes Red Hat Process Automation 7 Red Hat Single Sign-On 7 Red Hat support for Spring Boot CVSS Score CVSS v3 Base Score: 6.5 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality Impact: None Integrity Impact: None Availability Impact: High Frequently Asked Questions Why does Red Hat’s CVSS v3 score or impact differ from other vendors? My product is listed as “under investigation” or “affected”—when will Red Hat release a fix? If my product is listed as “not being fixed,” what should I do? What are mitigations? I have a Red Hat product, but it’s not on the above list—am I affected? Why is my security scanner reporting that my product is affected by this vulnerability, even though my product version is patched or not affected? Additional Information Disclaimer: This page was automatically generated and has not been checked for errors or omissions. For clarifications or corrections, please contact the Red Hat Product Security team. Copyright: CVE description copyright © 2021

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Keycloak CVE-2023-6841 DoS Vulnerability Advisory

More from this source