Описание
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | keycloak | Will not fix | ||
| Red Hat Mobile Application Platform 4 | keycloak | Out of support scope | ||
| Red Hat OpenShift Application Runtimes | keycloak | Affected | ||
| Red Hat Single Sign-On 7.2.5 zip | server | Fixed | RHSA-2018:3595 | 13.11.2018 |
| Red Hat Single Sign-On 7.2 for RHEL 6 | rh-sso7-keycloak | Fixed | RHSA-2018:3592 | 13.11.2018 |
| Red Hat Single Sign-On 7.2 for RHEL 7 | rh-sso7-keycloak | Fixed | RHSA-2018:3593 | 13.11.2018 |
| Text-Only RHOAR | Fixed | RHSA-2019:0877 | 24.04.2019 |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-345
https://bugzilla.redhat.com/show_bug.cgi?id=1599434keycloak: auth permitted with expired certs in SAML client
EPSS
Процентиль: 17%
0.00054
Низкий
5.4 Medium
CVSS3
Связанные уязвимости
CVSS3: 5.4
nvd
около 7 лет назад
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
CVSS3: 5.4
debian
около 7 лет назад
It was found that SAML authentication in Keycloak 3.4.3.Final incorrec ...
EPSS
Процентиль: 17%
0.00054
Низкий
5.4 Medium
CVSS3