Predictable password in Keycloak

2020-04-1521:09:27

Google

osv.dev

0.002 Low

EPSS

Percentile

56.1%

JSON

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.

CPENameOperatorVersion
org.keycloak:keycloak-coreeq2.1.0.Final
org.keycloak:keycloak-coreeq2.4.0.CR1
org.keycloak:keycloak-coreeq2.2.0.Final
org.keycloak:keycloak-coreeq4.0.0.Final
org.keycloak:keycloak-coreeq1.8.0.CR3
org.keycloak:keycloak-coreeq1.2.0.CR1
org.keycloak:keycloak-coreeq1.0-alpha-3
org.keycloak:keycloak-coreeq1.3.0.Final
org.keycloak:keycloak-coreeq1.9.1.Final
org.keycloak:keycloak-coreeq1.1.0.Beta1

Name	Operator	Version
org.keycloak:keycloak-core	eq	2.1.0.Final
org.keycloak:keycloak-core	eq	2.4.0.CR1
org.keycloak:keycloak-core	eq	2.2.0.Final
org.keycloak:keycloak-core	eq	4.0.0.Final
org.keycloak:keycloak-core	eq	1.8.0.CR3
org.keycloak:keycloak-core	eq	1.2.0.CR1
org.keycloak:keycloak-core	eq	1.0-alpha-3
org.keycloak:keycloak-core	eq	1.3.0.Final
org.keycloak:keycloak-core	eq	1.9.1.Final
org.keycloak:keycloak-core	eq	1.1.0.Beta1