PT-2019-4632 · Red Hat · Keycloak

Jonathan Christison + 1 · Published 2019-12-04 · Updated 2024-03-07 · CVE-2019-14910

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions 7.x

Description A vulnerability was found in Keycloak when configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server, allowing user authentication to succeed even with an invalid password. The issue is related to errors in the implementation of the authentication procedure. This could potentially allow a remote attacker to elevate their privileges.

Recommendations For Keycloak version 7.x, consider disabling the use of StartTLS with LDAP user federation until a patch is available, and ensure that SSL/TLS is used instead. Restrict access to the LDAP server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Improper Authentication

Weakness Enumeration

CWE-305

CWE-295

CWE-287

CWE-592

CWE-278

Related Identifiers

BDU:2020-00793

CVE-2019-14910

GHSA-JF86-9434-F8C2

Affected Products

Keycloak

References · 8

• https://bdu.fstec.ru/vul/2020-00793 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14910 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jf86-9434-f8c2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14910 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://access.redhat.com/security/cve/cve-2019-14910 · Note
• https://twitter.com/Esparta6108713/status/1765885773344071848 · Twitter Post