Keycloak vulnerable to uncontrolled resource consumption

GHSA-r32r-3977-cgc3 · CVE-2014-3651

Published Oct 18, 2018 · Modified Nov 8, 2023

Description

JBoss KeyCloak versions prior to 1.0.3.Final allow remote attackers to create a denial of service (resource consumption) by supplying a large value in the size parameter to auth/qrcode, related to QR code generation.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2014-3651
WEB https://bugzilla.redhat.com/show_bug.cgi?id=1144278
ADVISORY https://github.com/advisories/GHSA-r32r-3977-cgc3
WEB https://issues.jboss.org/browse/KEYCLOAK-699

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes