6.5
Moyenne
CVE-2017-2582 It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special…
Description
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| keycloak | 2.5.1 | Pas de correctif indiqué |
Références
- RHSA-2017:3220 access.redhat.com
- RHSA-2017:3216 access.redhat.com
- RHSA-2017:2809 access.redhat.com
- RHSA-2018:2740 access.redhat.com
- RHSA-2017:3218 access.redhat.com
- RHSA-2017:2810 access.redhat.com
- RHSA-2018:2741 access.redhat.com
- RHSA-2018:2742 access.redhat.com
- RHSA-2017:2808 access.redhat.com
- RHSA-2019:0137 access.redhat.com
- RHSA-2017:3219 access.redhat.com
- RHSA-2019:0139 access.redhat.com
- github.com github.com
- 1041707 www.securitytracker.com
- bugzilla.redhat.com bugzilla.redhat.com
- RHSA-2019:0136 access.redhat.com
- RHSA-2018:2743 access.redhat.com
- RHSA-2017:3217 access.redhat.com
- RHSA-2017:2811 access.redhat.com
- 101046 www.securityfocus.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de keycloak
Les 22 CVE de keycloak →
CVE-2020-14366
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible…
6.8
Moyenne
CVE-2020-1758
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while…
5.3
Moyenne
CVE-2020-1714
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without…
7.5
Élevée
CVE-2020-1718
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0
7.1
Élevée