CVE-2019-3868
Fixed in a distro release EPSS 1%CVSS 3.8
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
Products: Red Hat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | 6.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el7 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el7 |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6 |