Skip to content
VulniPulse
Sign in
Advisory severityHigh7.7Red Hat Linux

High [CVE-2023-6563] Keycloak: offline session token dos

This high-severity Red Hat Linux advisory covers CVE-2023-6563 affecting Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2023-6563 Source published Source updated

VulniPulse record published

CVE-2023-6563
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions).

If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.

While this vulnerability can enable complete compromise of system availability, it is not possible to be triggered in every environment. The impact is rated as Important due to several preconditions (number of users and how many sessions each user has) which are beyond an attacker's control.

Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H). Weakness: CWE-770.

Affected Red Hat products: Red Hat Single Sign-On 7.6 for RHEL 7; Red Hat Single Sign-On 7.6 for RHEL 8; Red Hat Single Sign-On 7.6 for RHEL 9; RHEL-8 based Middleware Containers; Single Sign-On 7.6.6. Red Hat lists Red Hat Build of Keycloak as not affected.

Red Hat fixing advisory: RHSA-2023:7854, RHSA-2023:7856, RHSA-2023:7855, RHSA-2023:7857, RHSA-2023:7858.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Fixed versions
  • rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el7sso
  • rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el8sso
  • rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el9sso
  • rh-sso-7/sso76-openshift-rhel8:7.6-38
  • rh-sso-7/sso7-rhel8-operator-bundle:7.6.6-2
  • rh-sso7-keycloak
  • RHSA-2023:7854
  • RHSA-2023:7856
  • RHSA-2023:7855
  • RHSA-2023:7857
  • RHSA-2023:7858

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • There are three main options to prevent exploitation: 1) If you are using a reverse proxy, block the consents URL. 2) This option is less effective: remove the consents application tab from the account console theme. 3) This option has a significant negative impact on end users: entirely disable offline user profiles.

Official advisory · high-confidence parse· fetched 21 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.