SB2020092408 - Denial of service in Keycloak
Published: September 24, 2020
Security Bulletin ID
SB2020092408
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2020-10758)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.
Remediation
Install update from vendor's website.