REDHAT-BUG-2328846: Medium severity Red Hat Keycloak vulnerability
A potential Denial of Service (DoS) vulnerability has been identified in Keycloak, which could allow an administrative user with the rights to change realm settings to disrupt the service. This is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that is already terminated, leading to a failure of said request.
Service disruption may happen, users will be unable to access applications relying on Keycloak, or any of the consoles provided by Keycloak itself on the affected realm.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2328846?
The severity of REDHAT-BUG-2328846 is considered critical due to its potential for Denial of Service.
How do I fix REDHAT-BUG-2328846?
To fix REDHAT-BUG-2328846, administrators should update to the latest version of Red Hat Build of Keycloak that addresses this vulnerability.
Who is affected by REDHAT-BUG-2328846?
REDHAT-BUG-2328846 affects administrative users of Red Hat Build of Keycloak who have permissions to change realm settings.
What causes the vulnerability in REDHAT-BUG-2328846?
The vulnerability in REDHAT-BUG-2328846 is caused by the ability to modify security headers and insert newlines, leading to a service disruption.
Is there a workaround for REDHAT-BUG-2328846?
Currently, there are no known workarounds for REDHAT-BUG-2328846; the best action is to apply the recommended updates.