CVE-2021-3856
Fixed in a distro release EPSS 1%
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
Products: redhat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | 15.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7.6 | rh-sso7 | 0:1-4.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7 | 0:1-4.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-javapackages-tools | 0:3.4.1-5.15.3.jbcs.el7 |
| Red Hat red hat single sign on 7.6 | rh-sso7-javapackages-tools | 0:3.4.1-5.15.6.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.0-2.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.0-2.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.0-2.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.0-2.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-python-javapackages | 0:3.4.1-5.15.3.jbcs.el7 |
| Red Hat red hat single sign on 7.6 | rh-sso7-python3-javapackages | 0:3.4.1-5.15.6.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-runtime | 0:1-4.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-runtime | 0:1-4.el8sso |