Bug 2254714 (CVE-2023-6841)

Summary: CVE-2023-6841 keycloak: Amount of attributes per object is not limited and it may lead to DOS
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aileenc, anstephe, avibelli, bgeorges, boliveir, chazlett, clement.escoffier, cmoulliard, dandread, dffrench, dhanak, dkreling, dpalmer, drichtar, drusso, ecerquei, gmalinko, gsmet, ibek, ikanello, janstey, jkoops, jmadigan, jmartisk, jrokos, jshepherd, kverlaen, lthon, manderse, max.andersen, mnovotny, mosmerov, mulliken, ngough, olubyans, pdelbell, pdrozd, peholase, pgallagh, pjindal, probinso, pskopek, pwright, rguimara, rmartinc, rowaters, rruss, rstepani, rsvoboda, sausingh, sbiarozk, sdouglas, security-response-team, sthorger, tqvarnst, trepel, ynojima
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2254713    
Deadline: 2024-09-10   

Description Rohit Keshri 2023-12-15 11:58:36 UTC 
Amount of attributes per object (users, groups, roles)) are not limited and the impact is

* The application can not accept too large amount of attributes
* The application is struggling to serve the content of the attribute later for one item
* The application fails to serve a list of items when attribute values are included in the list
* It is possible to cause a denial of service when hammering the list endpoint that serves many rows with long attribute values