Skip to content
fr Sign in
5.4 Medium

CVE-2023-6544 A flaw was found in the Keycloak package

Description

A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Keycloak 22 22 earliest → < 22-16 22-16
Red Hat build of Keycloak 22.0.10 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-46 7.6-46
RHSSO 7.6.8 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Keycloak 22

The 18 CVEs of Red Hat build of Keycloak 22 →
CVE-2023-0657 A flaw was found in Keycloak 3.4 Low CVE-2024-8883 A misconfiguration flaw was found in Keycloak 6.1 Medium CVE-2024-8698 A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class 7.7 High CVE-2024-7341 A session fixation issue was discovered in the SAML adapters provided by Keycloak 7.1 High
Track this CVE