keycloak/keycloak · Security
Keycloak vulnerable to infinite loop based Denial of Service
- GHSA ID
- GHSA-jc6q-27mw-p55w
- CVE ID
- CVE-2017-2646
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
When Keycloak versions prior to 2.5.5 receive a Logout request with an Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in an infinite loop. An attacker could use this flaw to conduct denial of service attacks.
CWEs
- CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')