Patchwire CVEs, their patch status, and feeds to follow them

CVE-2018-14637

Fixed in a distro release EPSS <1%CVSS 6.1

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.

Published 2018-11-30 · CVE record · OSV

Products: redhat keycloak

Fixed upstream

EcosystemPackageFixed in
Mavenorg.keycloak:keycloak-core4.6.0

Distro releases

ReleasePackageFixed in
Red Hat red hat single sign on 7rh-sso7-keycloak0:3.4.14-1.Final_redhat_00001.1.jbcs.el6
Red Hat red hat single sign on 7rh-sso7-keycloak0:3.4.14-1.Final_redhat_00001.1.jbcs.el7
Red Hat red hat single sign on 7rh-sso7-keycloak-server0:3.4.14-1.Final_redhat_00001.1.jbcs.el6
Red Hat red hat single sign on 7rh-sso7-keycloak-server0:3.4.14-1.Final_redhat_00001.1.jbcs.el7