GHSA-jf86-9434-f8c2 CVE-2019-14910
Keycloak Authentication Error
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.05%
- Chance of exploitation in the next 30 days. Higher than 64.41% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
- None yet
- No fixed version published
Description
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-parent | >= 7.0.0, <= 7.0.1 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-278: Insecure Preserved Inherited Permissions
A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it
- Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fwhw-chw4-gh37 Keycloak Server-Side Request Forgery (SSRF) vulnerability | Low | Also affects org.keycloak:keycloak-parent |
| GHSA-gv94-wp4h-vv8p Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-9hhc-pj4w-w5rv Keycloak Cross-site Scripting on OpenID connect login service | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-g8q8-fggx-9r3q Keycloak vulnerable to path traversal via double URL encoding | Critical | Also affects org.keycloak:keycloak-parent |
| GHSA-97g8-xfvw-q4hg Keycloak vulnerable to session takeover with OIDC offline refreshtokens | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-w9mf-83w3-fv49 Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles | Medium | Also affects org.keycloak:keycloak-parent |
| GHSA-wf7g-7h6h-678v Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console | High | Also affects org.keycloak:keycloak-parent |
| GHSA-xv7h-95r7-595j Incorrect implementation of lockout feature in Keycloak | High | Also affects org.keycloak:keycloak-parent |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor