PT-2019-4633 · Red Hat · Keycloak

Published 2019-12-04 · Updated 2022-05-24 · CVE-2019-14909

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions 7.x

Description A vulnerability was found in the user federation LDAP bind type, where any password will be accepted if the LDAP bind type is set to none (LDAP anonymous bind). The issue is related to errors in the implementation of the authentication procedure, which can allow a remote attacker to elevate their privileges.

Recommendations For Keycloak version 7.x, consider changing the LDAP bind type from none to a more secure option to mitigate the risk of exploitation. As a temporary workaround, restrict access to the LDAP authentication mechanism until a proper fix is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-305

CWE-592

Related Identifiers

BDU:2020-00794

CVE-2019-14909

GHSA-FV4Q-WM8C-WJG4

Affected Products

Keycloak

References · 7

• https://osv.dev/vulnerability/GHSA-fv4q-wm8c-wjg4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14909 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00794 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-14909 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909 · Note
• https://access.redhat.com/security/cve/cve-2019-14909 · Note