PT-2023-21738

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5 Description An issue was discovered in FvbServicesRuntimeDxe, which is an SMM module that exposes an SMI handler. This handler allows an attacker to interact with the SPI flash at run-time from the OS...

CVE-2023-28468

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS...

com.github.vzakharchenko:keycloak-plugins (1.2.4), com.github.vzakharchenko:mikrotik-radius-plugin (1.2.4) +19 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (10.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.2.4 -...

org.keycloak:keycloak-authz-policy-common (4.7.0.final), org.keycloak:keycloak-dependencies-server-min (4.7.0.final) +9 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (4.7.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 4.7.0.final -...

org.keycloak:keycloak-authz-policy-common (3.4.1.cr1), org.keycloak:keycloak-authz-policy-drools (3.4.1.cr1) +13 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (3.4.1.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 3.4.1.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.4.1.cr1 -...

org.keycloak:keycloak-authz-policy-common (4.2.1.final), org.keycloak:keycloak-dependencies-server-min (4.2.1.final) +9 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (4.2.1.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 4.2.1.final -...

com.charlyghislain.keycloak:keycloak-importexport (12.0.0), com.github.vzakharchenko:chillispot-radius-plugin (1.3.5) +34 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (12.0.4)

org.keycloak:keycloak-server-spi-private MAVEN version 12.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 12.0.0 -...

org.keycloak:keycloak-authz-policy-common (3.4.0.cr1), org.keycloak:keycloak-authz-policy-drools (3.4.0.cr1) +13 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (3.4.0.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 3.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.4.0.cr1 -...

com.github.vzakharchenko:keycloak-plugins (1.0.2), com.github.vzakharchenko:mikrotik-radius-plugin (1.0.2) +20 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (8.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.0.2 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-common (3.1.0.final) +12 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (3.1.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider (1.0.0), io.github.pckhoi.keycloak:webhook (19.0.2.1) +30 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (19.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider 1.0....

org.keycloak:keycloak-authz-policy-common (11.0.1), org.keycloak:keycloak-dependencies-server-all (11.0.1) +13 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (11.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 11.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 11.0.1 -...

de.adorsys.keycloak:keycloak-clientregistration-provider (>=1.2, <=3.0), de.adorsys.keycloak:keycloak-provider-extension (>=1.2, <=3.0) +16 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (3.4.3.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.keycloak:keycloak-clientregistration-provider =1.2, =1.2,...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.8, <=1.3.9), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.8, <=1.3.9) +31 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (14.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.8, =1.3.8, =1.3.8,...

net.micedre.keycloak:keycloak-mail-whitelisting (1.5), org.keycloak:keycloak-authz-policy-common (19.0.0) +26 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (19.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - net.micedre.keycloak:keycloak-mail-whitelisting 1.5 -...

io.github.trustedshops-public:spring-boot-starter-keycloak-path-based-resolver (1.0.4), net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (2.0) +51 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (20.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - io.github.trustedshops-public:spring-boot-starter-keycloak-path-based-resolver...

org.keycloak:keycloak-authz-policy-common (8.0.0), org.keycloak:keycloak-authz-policy-drools (8.0.0) +14 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (8.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 8.0.0 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.0, <=1.4.2), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.0, <=1.4.2) +34 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (17.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.4.0, =1.4.0, =1.4.0,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.4), com.github.vzakharchenko:cisco-radius-plugin (1.3.4) +31 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (12.0.3)

org.keycloak:keycloak-server-spi-private MAVEN version 12.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.4 -...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-authz-policy-common (4.2.0.final) +10 more potentially affected by CVE-2023-2585 via org.keycloak:keycloak-server-spi-private (4.2.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...