CVE-2019-14837
Fixed in a distro release EPSS 2%CVSS 9.1
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
Products: Red Hat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | 8.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:4.8.15-1.Final_redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:4.8.15-1.Final_redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:4.8.15-1.Final_redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:4.8.15-1.Final_redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:4.8.15-1.Final_redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:4.8.15-1.Final_redhat_00001.1.el8sso |