REDHAT-BUG-2262918
First published: Tue Feb 06 2024(Updated: )
A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages. Component affected: org.keycloak.protocol.oidc Version affected: <= 23.0.6
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Build of Keycloak | <=23.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2262918#c0
- https://access.redhat.com/errata/RHSA-2024:1860
- https://access.redhat.com/errata/RHSA-2024:1861
- https://access.redhat.com/errata/RHSA-2024:1862
- https://access.redhat.com/errata/RHSA-2024:1864
- https://access.redhat.com/errata/RHSA-2024:1866
- https://access.redhat.com/errata/RHSA-2024:1868
- https://access.redhat.com/errata/RHSA-2024:1867
- https://access.redhat.com/errata/RHSA-2024:2945
- https://access.redhat.com/errata/RHSA-2024:4057
- https://bugzilla.redhat.com/show_bug.cgi?id=2262918
Frequently Asked Questions
What is the severity of REDHAT-BUG-2262918?
The severity of REDHAT-BUG-2262918 is considered high due to its potential to enable DDoS attacks.
How do I fix REDHAT-BUG-2262918?
To fix REDHAT-BUG-2262918, update to the latest version of Red Hat Build of Keycloak beyond version 23.0.6.
What impact does REDHAT-BUG-2262918 have on my application?
REDHAT-BUG-2262918 allows attackers to send a high volume of unvalidated requests, which could disrupt application availability.
Which versions of Keycloak are affected by REDHAT-BUG-2262918?
Versions of Keycloak up to and including 23.0.6 are affected by REDHAT-BUG-2262918.
Is there a workaround for REDHAT-BUG-2262918?
Currently, there are no specific workarounds for REDHAT-BUG-2262918; updating to a secure version is recommended.
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-1249
- agent/references
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat build of keycloak