CVE-2023-6563
CVE-2023-6563: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.7
High [CVE-2023-6563] Keycloak: offline session token dos
CVE-2023-6563Source published Source updated
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system. While this vulnerability can enable complete compromise of system availability, it is not possible to be triggered in every environment. The impact is rated as Important due to several preconditions (number of users and how many sessions each user has) which are beyond an attacker's control. Red Hat severity…
- Affected products in this advisory
- Red Hat Single Sign-On 7.6 for RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 9
- RHEL-8 based Middleware Containers
1 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el7sso
- rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el8sso
- rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el9sso
- rh-sso-7/sso76-openshift-rhel8:7.6-38
7 more entries in the full advisory.
- Mitigation guidance
- There are three main options to prevent exploitation: 1) If you are using a reverse proxy, block the consents URL. 2) This option is less effective: remove the consents application tab from the account console theme. 3) This option has a significant negative impact on end users: entirely disable offline user profiles.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.