PT-2020-14910 · Red Hat · Keycloak

Marian Rehak + 1 · Published 2020-05-13 · Updated 2022-02-09 · CVE-2020-1714

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 11.0.0

Description A flaw was found in the code base where usages of ObjectInputStream are without type checks. This allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

Recommendations For versions prior to 11.0.0, update to version 11.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ObjectInputStream usage to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-1714

GHSA-M6MM-Q862-J366

RHSA-2020:2814

RHSA-2020:2816

Affected Products

Keycloak

References · 8

• https://github.com/keycloak/keycloak/pull/7053 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-1714 · Security Note
• https://osv.dev/vulnerability/GHSA-m6mm-q862-j366 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1714 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/33863ba16117844930a38ebde57a25258f5b80fd · Note
• https://t.me/cvenotify/3756 · Telegram Post