CVE-2014-3651: High severity red hat keycloak vulnerability
It was discovered that by requesting a large enough image size for a generated QR code, a remote attacker could cause uncontrolled resource consumption leading to denial of service for legitimate users.
Upstream Issue:
https://issues.jboss.org/browse/KEYCLOAK-699
Other sources
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3651?
CVE-2014-3651 is classified as a denial-of-service vulnerability that can lead to significant service disruption.
How do I fix CVE-2014-3651?
To mitigate CVE-2014-3651, upgrade Keycloak to version 1.0.4 or later, which addresses the vulnerability.
What causes the vulnerability in CVE-2014-3651?
CVE-2014-3651 is caused by uncontrolled resource consumption when generating QR codes of large sizes.
Can CVE-2014-3651 be exploited remotely?
Yes, CVE-2014-3651 can be exploited remotely by an attacker through crafted requests.
Which versions of Keycloak are affected by CVE-2014-3651?
CVE-2014-3651 affects Keycloak versions prior to 1.0.4.