A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the
    SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system
    resources due to a Regex complexity. (CVE-2024-10270)

Keycloak versions installed prior to 24.0.9, 25.0 prior to 26.0.6 are affected by multiple vulnerabilities as referenced in the advisory.

  - Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS     enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user      or client that leverages mTLS as the authentication mechanism. (CVE-2024-10039)

  - If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS)     scenario by exhausting system resources due to a Regex complexity. (CVE-2024-10270)

  - A user with high privileges could read sensitive information from a Vault file that is not within the     expected context. This attacker must have previous high access to the Keycloak server in order to perform     resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will     only inform whether that file exists or not. (CVE-2024-10492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
461304	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 24.0.9	Tenable Cloud Security	Echo Local Security Checks	Local	high
461304	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 24.0.9	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
420069	SCA: security update for org.keycloak:keycloak-services (GHSA-wq8x-cg39-8mrr)	Tenable Cloud Security	SCA Checks	Local	high
420069	SCA: security update for org.keycloak:keycloak-services (GHSA-wq8x-cg39-8mrr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
212078	Keycloak < 24.0.9, 25.0.x < 26.0.6 Multiple Vulnerabilities	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2024-10270

high

Tenable Plugins

high

high

high

high

high