CVE-2018-10894
Fixed in a distro release EPSS <1%CVSS 5.4
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
Products: Red Hat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-saml-adapter-core | 4.4.0.Final |
| Maven | org.keycloak:keycloak-services | 4.4.0.Final |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |