https://github.com/keycloak/keycloak/pull/8203

https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4

https://bugzilla.redhat.com/show_bug.cgi?id=1978196

https://access.redhat.com/security/cve/CVE-2021-3632

https://issues.redhat.com/browse/KEYCLOAK-18500

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3529 advisory.

  - jackson-dataformat-cbor:  Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError     exception (CVE-2020-28491)

  - keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity (CVE-2020-35509)

  - keycloak: Brute force attack is possible even after the account lockout (CVE-2021-3513)

  - keycloak: Anyone can register a new device when there is no device registered for passwordless login     (CVE-2021-3632)

  - keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly     could lead to a DoS attack (CVE-2021-3637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3527 advisory.

  - jackson-dataformat-cbor:  Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError     exception (CVE-2020-28491)

  - keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity (CVE-2020-35509)

  - keycloak: Brute force attack is possible even after the account lockout (CVE-2021-3513)

  - keycloak: Anyone can register a new device when there is no device registered for passwordless login     (CVE-2021-3632)

  - keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly     could lead to a DoS attack (CVE-2021-3637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3528 advisory.

  - jackson-dataformat-cbor:  Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError     exception (CVE-2020-28491)

  - keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity (CVE-2020-35509)

  - keycloak: Brute force attack is possible even after the account lockout (CVE-2021-3513)

  - keycloak: Anyone can register a new device when there is no device registered for passwordless login     (CVE-2021-3632)

  - keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly     could lead to a DoS attack (CVE-2021-3637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165157	RHEL 8 : Red Hat Single Sign-On 7.4.9 security update on RHEL 8 (Moderate) (RHSA-2021:3529)	Nessus	Red Hat Local Security Checks	high
165141	RHEL 6 : Red Hat Single Sign-On 7.4.9 security update on RHEL 6 (Moderate) (RHSA-2021:3527)	Nessus	Red Hat Local Security Checks	high
165123	RHEL 7 : Red Hat Single Sign-On 7.4.9 security update on RHEL 7 (Moderate) (RHSA-2021:3528)	Nessus	Red Hat Local Security Checks	high

CVE-2021-3632

high

Tenable Plugins

high

high

high