PT-2020-12310

Name of the Vulnerable Software and Affected Versions Keycloak version 10.0.1 Description A flaw in the data filter of Keycloak allows the processing of data URLs under certain circumstances, enabling an attacker to conduct cross-site scripting or further attacks. Recommendations For version...

PT-2020-14897

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 10.0.0 Description A flaw was found in Keycloak where the NodeJS adapter did not support the verify-token-audience. This results in some users having access to sensitive information outside of their permissions...

CVE-2020-10748: Improper Neutralization of Input During Web Page Generation

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks...

CVE-2020-1694: Permissive List of Allowed Inputs

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions...

CVE-2020-10758: Allocation of Resources Without Limits or Throttling

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body...

keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution

A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution...

Important: Red Hat Security Advisory: Red Hat Decision Manager 7.8.1 Security Update

An update is now available for Red Hat Decision Manager. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution

A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution...

PT-2020-5612

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 11.0.1 Description The issue is related to a denial of service DoS attack, which can be initiated remotely. It is caused by sending requests with a Content-Length header value that exceeds the actual byte count of th...

keycloak: security headers missing on REST endpoints

A flaw was found in Keycloak’s Admin Console, where it is missing HTTP security headers in HTTP responses. This issue is not a direct vulnerability and may not lead to a security issue, but increases the chances of allowing attackers to exploit other security flaws. Examples of these possible...

keycloak: DoS by sending multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body

A flaw was found in Keycloak. This flaw allows an attacker to perform a denial of service attack by sending multiple simultaneous requests with a Content-Length header value greater than the actual byte count of the request body. The highest threat from this vulnerability is to system availabilit...

Important: Red Hat Security Advisory: Red Hat build of Thorntail 2.7.1 security and bug fix update

An update is now available for Red Hat build of Thorntail. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

Red Hat keycloak resource management error vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A resource management error vulnerability exists in Red Hat keycloak. The vulnerability stems from a networked system or product that improperl...

Denial Of Service (DoS)

keycloak is vulnerable to denial of service DoS. The vulnerability exists through multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body...

CVE-2020-10758

A flaw was found in Keycloak. This flaw allows an attacker to perform a denial of service attack by sending multiple simultaneous requests with a Content-Length header value greater than the actual byte count of the request body. The highest threat from this vulnerability is to system availabilit...

keycloak: security headers missing on REST endpoints

A flaw was found in Keycloak’s Admin Console, where it is missing HTTP security headers in HTTP responses. This issue is not a direct vulnerability and may not lead to a security issue, but increases the chances of allowing attackers to exploit other security flaws. Examples of these possible...

keycloak: DoS by sending multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body

A flaw was found in Keycloak. This flaw allows an attacker to perform a denial of service attack by sending multiple simultaneous requests with a Content-Length header value greater than the actual byte count of the request body. The highest threat from this vulnerability is to system availabilit...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.2 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.2 security update on RHEL 8

New Red Hat Single Sign-On 7.4.2 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: security headers missing on REST endpoints

A flaw was found in Keycloak’s Admin Console, where it is missing HTTP security headers in HTTP responses. This issue is not a direct vulnerability and may not lead to a security issue, but increases the chances of allowing attackers to exploit other security flaws. Examples of these possible...