CVE-2022-1245
Fixed in a distro release EPSS 1%
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Products: redhat keycloak
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 18.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.6-1.redhat_00002.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.6-1.redhat_00002.1.el8sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.6-1.redhat_00002.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.6-1.redhat_00002.1.el8sso |