| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.keycloak:keycloak-model-jpa | < 21.0.0 | 21.0.0 |
| keycloak | < 21.0.0 | 21.0.0 |
| openshift container platform | = 4.11= 4.12 | |
| openshift container platform for ibm linuxone | = 4.10= 4.9 | |
| openshift container platform for power | = 4.10= 4.9 | |
| single sign-on | = 7.6 |
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン