PT-2019-4632 · Red Hat · Keycloak

Jonathan Christison + 1 · Publicado 2019-12-04 · Atualizado 2024-03-07 · CVE-2019-14910

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions 7.x

Description A vulnerability was found in Keycloak when configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server, allowing user authentication to succeed even with an invalid password. The issue is related to errors in the implementation of the authentication procedure. This could potentially allow a remote attacker to elevate their privileges.

Recommendations For Keycloak version 7.x, consider disabling the use of StartTLS with LDAP user federation until a patch is available, and ensure that SSL/TLS is used instead. Restrict access to the LDAP server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Improper Authentication

Enumeração de Fraquezas

CWE-295

CWE-592

CWE-287

CWE-305

CWE-278

Identificadores relacionados

BDU:2020-00793

CVE-2019-14910

GHSA-JF86-9434-F8C2

Produtos afetados

Keycloak

Referências · 8

• https://github.com/keycloak/keycloak · Nota
• https://osv.dev/vulnerability/CVE-2019-14910 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jf86-9434-f8c2 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00793 · Nota de Segurança
• https://twitter.com/Esparta6108713/status/1765885773344071848 · Publicação no Twitter
• https://access.redhat.com/security/cve/cve-2019-14910 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14910 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14910 · Aviso do Fabricante