CVE-2019-10199

CVE-2019-10199 affects Keycloak up to version 6.0.1. The account console did not perform adequate header checks in some requests, enabling an attacker to trigger operations by crafting requests from an untrusted domain and persuading an authenticated user to perform actions. Red Hat advisories li...

keycloak: SAML broker does not check existence of signature on document allowing any user impersonation

It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.3.3 security update

A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: CSRF check missing in My Resources functionality in the Account Console

It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...

keycloak-httpd-client-install security, bug fix, and enhancement update

0.8-1 - Resolves: rhbz1673716 - Rebase k-h-c-i to version 0.8 - The rebase also includes fixes for: - rhbz1533190 - CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloakcli.py - rhbz1533202 - CVE-2017-15112 keycloak-httpd-client-install: unsafe use of...

RHEL 7 : keycloak-httpd-client-install (RHSA-2019:2137)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2137 advisory. The keycloak-httpd-client-install packages provide various libraries and tools that can automate and simplify the configuration of Apache...

Unauthorized File Overwrite

keycloak-httpd-client-install is vulnerable to unauthorized file overwrite. Unsafe creation of log file in /tmp via the --log-file option in keycloakcli.py allows local attackers to overwrite other files via symbolic link...

Low: Red Hat Security Advisory: keycloak-httpd-client-install security, bug fix, and enhancement update

An update for keycloak-httpd-client-install is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak-httpd-client-install: unsafe use of -p/--admin-password on command line

In keycloak-http-client-install prior to version 0.8, the admin password could be provided through a command-line argument. This might result in the password being leaked through shell history, or becoming visible to a local attacker at the time the program is running...

keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloak_cli.py

It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service...

Information Disclosure

keycloak is vulnerable to information disclosure. A misuse of client-side /etc/hosts entry to spoof a URL in a password reset request allows an attacker to craft a malicious password request and obtain a valid reset token, resulting in unauthorized password change and access to the application...

Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself CDP or through the separately configured path. The CRL are often availab...

GHSA-38CG-GG9J-Q9J9 Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself CDP or through the separately configured path. The CRL are often availab...

Denial Of Service (DoS)

keycloak-connect is vulnerable to denial of service. Failure to validate JWT signatures on /klogout route allows remote attackers to force logout users and indefinitely deny service to the application using malicious JWTs with NBF values...

Forced Logout

Overview Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to...

Red Hat Keycloak Security Bypass Vulnerability (CNVD-2019-44531)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security bypass vulnerability exists in Red Hat Keycloak versions prior to 6.0.2, which can be exploited by an attacker to conduct a...

@devsisters/passport (>=1.1.0, <=1.1.2), @project-sunbird/ext-framework-server (8.0.0) +4 more potentially affected by CVE-2019-10157 via keycloak-connect (>=4.0.0-beta.1, <=4.5.0)

keycloak-connect NPM version =4.0.0-beta.1, =1.1.0, =0.0.2, =0.0.1, =0.0.1-alpha-1, =1.2.7 Source cves: CVE-2019-10157 Source advisory: OSV:GHSA-68HW-VFH7-XVG8...

GHSA-68HW-VFH7-XVG8 Forced Logout in keycloak-connect

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...

Forced Logout in keycloak-connect

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...

CVE-2019-3875

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself CDP or through the separately configured path. The CRL are often availab...