CVE-2020-10758: High severity redhat keycloak vulnerability

Q: What is the vulnerability ID of this flaw in Keycloak?

The vulnerability ID of this flaw in Keycloak is CVE-2020-10758.

Q: What is the impact of the CVE-2020-10758 vulnerability?

The highest threat from the CVE-2020-10758 vulnerability is to system availability.

Q: How can an attacker exploit the CVE-2020-10758 vulnerability?

An attacker can exploit the CVE-2020-10758 vulnerability by sending multiple simultaneous requests with a Content-Length header value greater than the actual byte count of the request body.

Q: Which versions of Keycloak are affected by CVE-2020-10758?

Versions prior to 11.0.1 of Keycloak are affected by CVE-2020-10758.

Q: How do I fix the CVE-2020-10758 vulnerability in Keycloak?

To fix the CVE-2020-10758 vulnerability in Keycloak, you should update your Keycloak installation to version 11.0.1 or higher.

Published Jun 4, 2020

Updated

A flaw was found in Keycloak. This flaw allows an attacker to perform a denial of service attack by sending multiple simultaneous requests with a Content-Length header value greater than the actual byte count of the request body. The highest threat from this vulnerability is to system availability.

Other sources

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.

DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.

https://issues.redhat.com/browse/KEYCLOAK-14363

— Red Hat

Affected Software

10 affected componentsFixes available

redhat/rh-sso7-keycloak<0:9.0.5-1.redhat_00001.1.el6

0:9.0.5-1.redhat_00001.1.el6

redhat/rh-sso7-keycloak<0:9.0.5-1.redhat_00001.1.el7

0:9.0.5-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:9.0.5-1.redhat_00001.1.el8

0:9.0.5-1.redhat_00001.1.el8

redhat/keycloak<11.0.1

11.0.1

redhat keycloak<11.0.1

redhat Openshift Application Runtimes

redhat Openshift Application Runtimes=1.0

redhat Single Sign-on

redhat Single Sign-on=7.0

redhat Single Sign-on=7.4

Remediation

Patch Available

https://github.com/keycloak/keycloak/commit/bee4ca89897766c4b68856eafe14f1a3dad34251

Information

- The possibility of this issue largely depends on the environment, specifically the load balancer or reverse proxies between the client and the server. The issue occurs when there is no load balancer in place. - Proper tuning of HTTP request timeout and keycloak database max pool size can mitigate this issue : bin/jboss-cli.sh --connect --commands='/subsystem=transactions:write-attribute(name=default-timeout,value=30),/subsystem=undertow/server=default-server/http-listener=default/:write-attribute(name=read-timeout,value=30000),/subsystem=undertow/server=default-server/https-listener=https/:write-attribute(name=read-timeout,value=30000),/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=max-pool-size,value=100),reload'

Event History

Aug 18, 2020

CVE Published

12:00 AM

Sep 16, 2020

CVE Published

via MITRE·03:05 PM

Data Sourced

via MITRE·03:05 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the vulnerability ID of this flaw in Keycloak?