Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2019-10199

It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

org.keycloak:keycloak-account-api (1.0.1.final), org.keycloak:keycloak-account-freemarker (1.0.1.final) +48 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.0.1.final)

org.keycloak:keycloak-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.1.final - org.keycloak:keycloak-account-freemarker 1.0.1.final ...

org.keycloak:keycloak-adapter-core (2.5.0.cr1), org.keycloak:keycloak-admin-client (2.5.0.cr1) +52 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (2.5.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.0.cr1 - org.keycloak:keycloak-admin-client 2.5.0.cr1 -...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), de.retest:recheck (>=1.2.0-beta.1, <=1.4.0) +87 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (>=6.0.0, <=6.0.1)

org.keycloak:keycloak-core MAVEN version =6.0.0, =0.29.1, =1.2.0-beta.1, =1.3.0-beta.1, =0.0.7, =0.0.7, =0.0.6, =1.0.6, =0.0.6, =0.0.6, =1.0.6, =0.14.0, =0.14.0, =5.0.9, =5.0.9, =9.0.8 and more Source cves: CVE-2019-10199 Source advisory: GHSA-P5XP-6VPF-JWVH...

org.keycloak:keycloak-adapter-core (1.9.5.final), org.keycloak:keycloak-admin-client (1.9.5.final) +43 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.9.5.final)

org.keycloak:keycloak-core MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 1.9.5.final - org.keycloak:keycloak-admin-client 1.9.5.final -...

org.keycloak:keycloak-account-api (1.0-alpha-3), org.keycloak:keycloak-account-freemarker (1.0-alpha-3) +21 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.0-alpha-3)

org.keycloak:keycloak-core MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-alpha-3 - org.keycloak:keycloak-account-freemarker 1.0-alpha-3 ...

org.keycloak:keycloak-account-api (1.0-beta-1), org.keycloak:keycloak-account-freemarker (1.0-beta-1) +38 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.0-beta-1)

org.keycloak:keycloak-core MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-beta-1 - org.keycloak:keycloak-account-freemarker 1.0-beta-1 -...

org.keycloak:keycloak-account-api (1.0-beta-1-20150523), org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150523) +36 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.0-beta-1-20150523)

org.keycloak:keycloak-core MAVEN version 1.0-beta-1-20150523 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-beta-1-20150523 -...

org.jboss.aerogear.test:aerogear-ups-rest-api (>=1.0.0.beta1, <=1.0.0.beta2), org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1) +43 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.0-beta-3)

org.keycloak:keycloak-core MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.test:aerogear-ups-rest-api =1.0.0.beta1, =0.11.0, =0.11.0, =0.11.0, =1.0.0.beta1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.0.beta2) +49 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.0-beta-4)

org.keycloak:keycloak-core MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

org.hawkular.accounts:hawkular-accounts (>=2.0.20.final, <=2.0.22.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.20.final, <=2.0.22.final) +93 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.8.1.final)

org.keycloak:keycloak-core MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.20.final, =2.0.20.final, =2.0.20.final, =2.0.20.final,...

org.kathra:kathra-appmanager-interface (>=1.0.0, <=1.1.0), org.kathra:kathra-appmanager-swagger (>=1.0.0, <=1.1.0) +96 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (4.2.1.final)

org.keycloak:keycloak-core MAVEN version 4.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.kathra:kathra-appmanager-interface =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0...

org.keycloak:keycloak-adapter-core (3.2.0.cr1), org.keycloak:keycloak-admin-client (3.2.0.cr1) +56 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (3.2.0.cr1)

org.keycloak:keycloak-core MAVEN version 3.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 3.2.0.cr1 - org.keycloak:keycloak-admin-client 3.2.0.cr1 -...

org.keycloak:keycloak-adapter-core (3.3.0.cr2), org.keycloak:keycloak-admin-client (3.3.0.cr2) +56 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (3.3.0.cr2)

org.keycloak:keycloak-core MAVEN version 3.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 3.3.0.cr2 - org.keycloak:keycloak-admin-client 3.3.0.cr2 -...

io.github.johnjcool:keycloak-cas-services (4.4.0.final), io.gravitee.resource:gravitee-resource-oauth2-provider-keycloak (1.1.0) +65 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (4.4.0.final)

org.keycloak:keycloak-core MAVEN version 4.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.4.0.final -...

org.hawkular.accounts:hawkular-accounts (>=2.0.14.final, <=2.0.17.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.14.final, <=2.0.17.final) +91 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.8.0.cr3)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.14.final, =2.0.14.final, =2.0.14.final, =2.0.14.final,...

org.keycloak:keycloak-account-api (1.0.3.final), org.keycloak:keycloak-account-freemarker (1.0.3.final) +48 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.0.3.final)

org.keycloak:keycloak-core MAVEN version 1.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.3.final - org.keycloak:keycloak-account-freemarker 1.0.3.final ...

com.kurzdigital:keycloak-admin-wrapper (>=0.9.11, <=0.10.3), com.pleosoft:pleosoft-spring-boot-starter (1.0.5-release) +105 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (4.8.3.final)

org.keycloak:keycloak-core MAVEN version 4.8.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.kurzdigital:keycloak-admin-wrapper =0.9.11, =1.1.0, =1.2.2, =1.2.2, =7.1.0.m5, =7.1.0.m5,...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.7.0, <=0.7.1), io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.2.final, <=1.2.3.final) +51 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (1.9.0.final)

org.keycloak:keycloak-core MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.7.0, =1.2.2.final, =1.2.2.final, =1.2.2.final,...