Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2021-3637
CVE-2021-3637:
Java vulnerability analysis and mitigation
Overview
A vulnerability (CVE-2021-3637) was discovered in keycloak-model-infinispan affecting Keycloak versions before 14.0.0. The flaw involves the authenticationSessions map in RootAuthenticationSessionEntity, which grows boundlessly and could potentially lead to a Denial of Service (DoS) attack (CVE Mitre, Red Hat Bugzilla).
Technical details
The vulnerability exists in the keycloak-model-infinispan component where the authenticationSessions map in RootAuthenticationSessionEntity lacks proper bounds checking, allowing unlimited growth of the map. This unbounded growth can potentially exhaust system resources (Red Hat Bugzilla).
Impact
The primary impact of this vulnerability is the potential for Denial of Service (DoS) attacks due to unbounded resource consumption in the authentication sessions mapping. This could affect system availability and performance of Keycloak installations (CVE Mitre).
Mitigation and workarounds
The vulnerability has been fixed in Keycloak version 14.0.0 and later. Red Hat has released security updates for affected versions of Red Hat Single Sign-On 7.4 across RHEL 6, 7, and 8 platforms through multiple security advisories (RHSA-2021:3527, RHSA-2021:3528, RHSA-2021:3529, and RHSA-2021:3534) (Red Hat Advisory).
Additional resources
Source: This report was generated using AI
Related Java vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management