CVE-2020-14389
Fixed in a distro release EPSS <1%
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.
Products: redhat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | 12.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:9.0.9-1.redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:9.0.9-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak | 0:9.0.9-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:9.0.9-1.redhat_00001.1.el6sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:9.0.9-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7 | rh-sso7-keycloak-server | 0:9.0.9-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java | 0:0.8.0-2.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java-debuginfo | 0:0.8.0-2.el8sso |
| Red Hat red hat single sign on 7 | rh-sso7-libunix-dbus-java-devel | 0:0.8.0-2.el8sso |