A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A denial of service vulnerability was found in Keycloak that could allow an administrative user with the
    right to change realm settings to disrupt the service. This action is done by modifying any of the
    security headers and inserting newlines, which causes the Keycloak server to write to a request that has
    already been terminated, leading to the failure of said request. (CVE-2024-11734)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5e2bd238-d2bb-11ef-bc0e-1c697a616631 advisory.

    Keycloak reports:
    This update includes 2 security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Keycloak installed on the remote host is prior to 26.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 26_0_8 advisory.

  - A denial of service vulnerability was found in Keycloak that could allow an administrative user with the     right to change realm settings to disrupt the service. This action is done by modifying any of the     security headers and inserting newlines, which causes the Keycloak server to write to a request that has     already been terminated, leading to the failure of said request. (CVE-2024-11734)

  - A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment     variables and system properties through user-configurable URLs. When configuring backchannel logout URLs     or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server     replaces these placeholders with the actual values of environment variables or system properties during     URL processing. (CVE-2024-11736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
419655	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-w3g8-r9gw-qrh8)	Tenable Cloud Security	SCA Checks	Local	medium
419655	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-w3g8-r9gw-qrh8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
214220	FreeBSD : keycloak -- Multiple security fixes (5e2bd238-d2bb-11ef-bc0e-1c697a616631)	Nessus	FreeBSD Local Security Checks	Local	medium
214216	Keycloak 26.0.8 Multiple Vulnerabilities (26_0_8)	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2024-11734

medium

Tenable Plugins

medium

medium

medium

medium