Vulnerabilities of Red Hat keycloak

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2020-14366	A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible…	6.8 Medium	Nov 9, 2020
CVE-2020-1758	A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while…	5.3 Medium	May 15, 2020
CVE-2020-1714	A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without…	7.5 High	May 13, 2020
CVE-2020-1718	A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0	7.1 High	May 12, 2020
CVE-2020-1724	A flaw was found in Keycloak in versions before 9.0.2	4.3 Medium	May 11, 2020
CVE-2020-1698	A flaw was found in keycloak in versions before 9.0.0	5.0 Medium	May 11, 2020
CVE-2020-1744	A flaw was found in keycloak before version 9.0.1	5.6 Medium	Mar 24, 2020
CVE-2020-1731	A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator…	9.1 Critical	Mar 2, 2020
CVE-2020-1697	It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the…	6.1 Medium	Feb 10, 2020
CVE-2019-14837	A flaw was found in keycloack before version 8.0.0	9.1 Critical	Jan 7, 2020
CVE-2019-10201	It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures	8.1 High	Aug 14, 2019
CVE-2019-10199	It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests	4.6 Medium	Aug 14, 2019
CVE-2019-3875	A vulnerability was found in keycloak before 6.0.2	6.5 Medium	Jun 12, 2019
CVE-2019-10157	It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from…	4.7 Medium	Jun 12, 2019
CVE-2019-3868	Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for…	3.8 Low	Apr 24, 2019
CVE-2018-14658	A flaw was found in JBOSS Keycloak 3.2.1.Final	6.1 Medium	Nov 13, 2018
CVE-2018-14657	A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final	5.4 Medium	Nov 13, 2018
CVE-2018-14655	A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final	4.6 Medium	Nov 13, 2018
CVE-2018-10894	It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates	5.4 Medium	Aug 1, 2018
CVE-2016-8609	It was found that the keycloak before 2.3.0 did not implement authentication flow correctly	3.7 Low	Aug 1, 2018
CVE-2017-2646	It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request,…	7.5 High	Jul 27, 2018
CVE-2017-2582	It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special…	6.5 Medium	Jul 26, 2018

Other Red Hat products