CVE-2019-14820
Fixed in a distro release EPSS <1%CVSS 4.3
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Products: keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | 8.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss enterprise application platform 6 | keycloak-adapter-sso7_3-eap6 | 0:4.8.13-1.Final_redhat_00001.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | keycloak-adapter-sso7_3-eap6 | 0:4.8.13-1.Final_redhat_00001.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | keycloak-saml-adapter-sso7_3-eap6 | 0:4.8.13-1.Final_redhat_00001.1.ep6.el7 |
| Red Hat jboss enterprise application platform 6 | keycloak-saml-adapter-sso7_3-eap6 | 0:4.8.13-1.Final_redhat_00001.1.ep6.el6 |
| Red Hat jboss enterprise application platform 7.2 | eap7-keycloak-adapter-sso7_3 | 0:4.8.13-1.Final_redhat_00001.1.el8eap |
| Red Hat jboss enterprise application platform 7.2 | eap7-keycloak-adapter-sso7_3 | 0:4.8.13-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.2 | eap7-keycloak-adapter-sso7_3 | 0:4.8.13-1.Final_redhat_00001.1.el6eap |
| Red Hat jboss enterprise application platform 7.2 | eap7-keycloak-saml-adapter-sso7_3 | 0:4.8.13-1.Final_redhat_00001.1.el6eap |
| Red Hat jboss enterprise application platform 7.2 | eap7-keycloak-saml-adapter-sso7_3 | 0:4.8.13-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform 7.2 | eap7-keycloak-saml-adapter-sso7_3 | 0:4.8.13-1.Final_redhat_00001.1.el8eap |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:4.8.13-1.Final_redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:4.8.13-1.Final_redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:4.8.13-1.Final_redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:4.8.13-1.Final_redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:4.8.13-1.Final_redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:4.8.13-1.Final_redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java | 0:0.8.0-2.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java-debuginfo | 0:0.8.0-2.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java-devel | 0:0.8.0-2.el7sso |