PT-2018-12632 · Red Hat · Keycloak

Laura Pardo · Publicado 2018-11-30 · Atualizado 2019-10-09 · CVE-2018-14637

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 4.6.0.Final

Description The issue concerns the SAML broker consumer endpoint in Keycloak, which ignores expiration conditions on SAML assertions. This can be exploited by an attacker to perform a replay attack.

Recommendations For versions prior to 4.6.0.Final, update to version 4.6.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the SAML broker consumer endpoint to minimize the risk of exploitation.

Correção

Improper Authentication

Improper Authorization

Enumeração de Fraquezas

CWE-287

CWE-285

Identificadores relacionados

CVE-2018-14637

GHSA-GF2J-7QWG-4F5X

RHSA-2018:3592

RHSA-2018:3593

Produtos afetados

Keycloak

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-14637 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14637 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14637 · Nota
• https://osv.dev/vulnerability/GHSA-gf2j-7qwg-4f5x · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14637 · Nota
• https://github.com/advisories/GHSA-gf2j-7qwg-4f5x · Nota