Insufficient Session Expiration in Keycloak - CVE-2021-3461
Published: May 25, 2021 / Updated: May 25, 2021
Vulnerability identifier: #VU53530
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3461
CWE-ID: CWE-613
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to gain access to sensitive information.
The vulnerability exists due to the way Keycloak handles backchannel logout requests. If the logout request comes from an external SAML identity provider and Principal Type is set to Attribute [Name], the application ignores such request.
Affected software
Keycloak
Red Hat Single Sign-On
Arch Linux
rh-sso7-keycloak (Red Hat package)
Red Hat Single Sign-On
Arch Linux
rh-sso7-keycloak (Red Hat package)
How to mitigate CVE-2021-3461
Install update from vendor's website.
Keycloak - update to 13.0.1
Red Hat Single Sign-On - update to 7.4.7
rh-sso7-keycloak (Red Hat package) - addressed in versions 9.0.13-1.redhat_00006.1.el6sso, 9.0.13-1.redhat_00006.1.el7sso, 9.0.13-1.redhat_00006.1.el8sso
Red Hat Single Sign-On - update to 7.4.7
rh-sso7-keycloak (Red Hat package) - addressed in versions 9.0.13-1.redhat_00006.1.el6sso, 9.0.13-1.redhat_00006.1.el7sso, 9.0.13-1.redhat_00006.1.el8sso