PT-2018-12632 · Red Hat · Keycloak

Laura Pardo · Published 2018-11-30 · Updated 2019-10-09 · CVE-2018-14637

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 4.6.0.Final

Description The issue concerns the SAML broker consumer endpoint in Keycloak, which ignores expiration conditions on SAML assertions. This can be exploited by an attacker to perform a replay attack.

Recommendations For versions prior to 4.6.0.Final, update to version 4.6.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the SAML broker consumer endpoint to minimize the risk of exploitation.

Fix

Improper Authentication

Improper Authorization

Weakness Enumeration

CWE-287

CWE-285

Related Identifiers

CVE-2018-14637

GHSA-GF2J-7QWG-4F5X

RHSA-2018:3592

RHSA-2018:3593

Affected Products

Keycloak

References · 6

• https://osv.dev/vulnerability/CVE-2018-14637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14637 · Security Note
• https://osv.dev/vulnerability/GHSA-gf2j-7qwg-4f5x · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14637 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14637 · Note
• https://github.com/advisories/GHSA-gf2j-7qwg-4f5x · Note