CVE-2020-10776
Fixed in a distro release EPSS <1%
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
Products: redhat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-server-spi-private | 12.0.0 |
| Maven | org.keycloak:keycloak-services | 12.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:9.0.9-1.redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:9.0.9-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:9.0.9-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:9.0.9-1.redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:9.0.9-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:9.0.9-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java | 0:0.8.0-2.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java-debuginfo | 0:0.8.0-2.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java-devel | 0:0.8.0-2.el8sso |