Untriaged
Permalink
CVE-2024-11734
6.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): HIGH
Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers
A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request.
References
Affected products
keycloak
- <26.0.8
rhbk/keycloak-rhel9
- *
rhbk/keycloak-rhel9-operator
- *
rhbk/keycloak-operator-bundle
- *
org.keycloak/keycloak-quarkus-server
Matching in nixpkgs
pkgs.keycloak
Identity and access management for modern applications and services
pkgs.terraform-providers.keycloak
None
pkgs.python311Packages.python-keycloak
Provides access to the Keycloak API
pkgs.python312Packages.python-keycloak
Provides access to the Keycloak API
Package maintainers
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>