org.keycloak:keycloak-dependencies-server-all (3.0.0.final), org.keycloak:keycloak-services (3.0.0.final) potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (3.0.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 3.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.0.0.final -...

org.keycloak:keycloak-services (4.8.0.final) potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (4.8.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 4.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-services 4.8.0.final Source cves: CVE-2024-5967 Source...

org.keycloak:keycloak-dependencies-server-all (1.7.0.cr1) potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (1.7.0.cr1)

org.keycloak:keycloak-ldap-federation MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.7.0.cr1 Source cves: CVE-2024-596...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +11 more potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (>=23.0.0, <=24.0.5)

org.keycloak:keycloak-ldap-federation MAVEN version =23.0.0, =2.5.6-24.0, =0.47, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =24.0.0, =23.0.0, =23.0.0, =23.0.0, =24.0.5 Source cves: CVE-2024-5967 Source advisory: GHSA-C25H-C27Q-5QPV...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.7, <=1.4.8), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.7, <=1.4.8) +17 more potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (19.0.1)

org.keycloak:keycloak-ldap-federation MAVEN version 19.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.4.7, =1.4.7, =1.4.7, =1.4.7,...

org.keycloak:keycloak-dependencies-server-all (1.0.3.final), org.keycloak:keycloak-server (1.0.3.final) potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (1.0.3.final)

org.keycloak:keycloak-ldap-federation MAVEN version 1.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.0.3.final -...

io.phasetwo.keycloak:keycloak-orgs (>=0.76, <=0.78), org.keycloak:keycloak-dependencies-server-all (25.0.0) +7 more potentially affected by CVE-2024-5967 via org.keycloak:keycloak-ldap-federation (25.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - io.phasetwo.keycloak:keycloak-orgs =0.76, =0.78 -...

io.kokuwa.keycloak:keycloak-event-metrics (0.2.1), org.keycloak:keycloak-crypto-fips1402 (21.1.0) +13 more potentially affected by CVE-2024-1722 via org.keycloak:keycloak-services (21.1.0)

org.keycloak:keycloak-services MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 0.2.1 - org.keycloak:keycloak-crypto-fips1402 21.1.0 -...

net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (2.0), net.optionfactory.keycloak:optionfactory-keycloak-email-sender (2.0) +17 more potentially affected by CVE-2021-3754 via org.keycloak:keycloak-services (20.0.0)

org.keycloak:keycloak-services MAVEN version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider 2.0 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2023-0657 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

net.micedre.keycloak:keycloak-mail-whitelisting (1.5), org.keycloak:keycloak-dependencies-server-all (19.0.0) +15 more potentially affected by CVE-2023-0657 via org.keycloak:keycloak-services (19.0.0)

org.keycloak:keycloak-services MAVEN version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - net.micedre.keycloak:keycloak-mail-whitelisting 1.5 - org.keycloak:keycloak-dependencies-server-al...

com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider (1.0.0), io.github.pckhoi.keycloak:webhook (19.0.2.1) +19 more potentially affected by CVE-2023-0657 via org.keycloak:keycloak-services (19.0.2)

org.keycloak:keycloak-services MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider 1.0.0 -...

io.kokuwa.keycloak:keycloak-event-metrics (0.2.1), org.keycloak:keycloak-crypto-fips1402 (21.1.0) +13 more potentially affected by CVE-2024-1249 via org.keycloak:keycloak-services (21.1.0)

org.keycloak:keycloak-services MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 0.2.1 - org.keycloak:keycloak-crypto-fips1402 21.1.0 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.4), org.keycloak:keycloak-dependencies-server-all (20.0.4) +10 more potentially affected by CVE-2024-2419 via org.keycloak:keycloak-services (20.0.4)

org.keycloak:keycloak-services MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.4 -...

io.kokuwa.keycloak:keycloak-event-metrics (0.2.1), org.keycloak:keycloak-crypto-fips1402 (21.1.0) +13 more potentially affected by CVE-2023-6291 via org.keycloak:keycloak-services (21.1.0)

org.keycloak:keycloak-services MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 0.2.1 - org.keycloak:keycloak-crypto-fips1402 21.1.0 -...

LDAP Injection

keycloak-ldap-federation, keycloak-services is vulnerable to LDAP Injection. The vulnerability is due to the getFilterById function in LDAPOperationManager.java and getUserFromForm function in AbstractUsernameFormAuthenticator.java. This allows an attacker to manipulate the LDAP query in...

org.keycloak:keycloak-dependencies-server-all (2.4.0.final), org.keycloak:keycloak-services (2.4.0.final) potentially affected by CVE-2022-2232 via org.keycloak:keycloak-ldap-federation (2.4.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 2.4.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.0-beta-4) potentially affected by CVE-2022-2232 via org.keycloak:keycloak-ldap-federation (1.0-beta-4)

org.keycloak:keycloak-ldap-federation MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.0-beta-4 Source cves:...

org.keycloak:keycloak-dependencies-server-all (3.1.0.final), org.keycloak:keycloak-services (3.1.0.final) potentially affected by CVE-2022-2232 via org.keycloak:keycloak-ldap-federation (3.1.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.1.0.final -...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0, <=0.2.0), io.phasetwo.keycloak:keycloak-orgs (>=0.11, <=0.23) +8 more potentially affected by CVE-2022-2232 via org.keycloak:keycloak-ldap-federation (21.0.1)

org.keycloak:keycloak-ldap-federation MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics =0.1.0, =0.11, =0.23 -...