En resumen
- CVE-2017-2646 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a org.keycloak:keycloak-core, keycloak (redhat).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.8%, mayor que el 78.9% de las vulnerabilidades.
- Solución: actualizar a 2.5.5 o posterior.
Description
When Keycloak versions prior to 2.5.5 receive a Logout request with an Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in an infinite loop. An attacker could use this flaw to conduct denial of service attacks.
NVD description
It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.
Más vulnerabilidades de org.keycloak:keycloak-core
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free