REDHAT-BUG-2328846
First published: Tue Nov 26 2024(Updated: )
A potential Denial of Service (DoS) vulnerability has been identified in Keycloak, which could allow an administrative user with the rights to change realm settings to disrupt the service. This is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that is already terminated, leading to a failure of said request. Service disruption may happen, users will be unable to access applications relying on Keycloak, or any of the consoles provided by Keycloak itself on the affected realm.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Keycloak |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2328846?
The severity of REDHAT-BUG-2328846 is considered critical due to its potential for Denial of Service.
How do I fix REDHAT-BUG-2328846?
To fix REDHAT-BUG-2328846, administrators should update to the latest version of Red Hat Build of Keycloak that addresses this vulnerability.
Who is affected by REDHAT-BUG-2328846?
REDHAT-BUG-2328846 affects administrative users of Red Hat Build of Keycloak who have permissions to change realm settings.
What causes the vulnerability in REDHAT-BUG-2328846?
The vulnerability in REDHAT-BUG-2328846 is caused by the ability to modify security headers and insert newlines, leading to a service disruption.
Is there a workaround for REDHAT-BUG-2328846?
Currently, there are no known workarounds for REDHAT-BUG-2328846; the best action is to apply the recommended updates.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-11734
- agent/last-modified-date
- agent/severity
- agent/references
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/keycloak