PT-2021-9172 · Red Hat · Keycloak

Guilherme De Almeida Suckevicz · Published 2021-02-11 · Updated 2022-04-28 · CVE-2020-10734

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions keycloak versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes

Description A vulnerability was found in the way keycloak handles the OIDC logout endpoint, which does not have CSRF protection. The highest threat from this vulnerability is to system availability.

Recommendations For versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes, consider disabling the OIDC logout endpoint as a temporary workaround until a patch is available. Restrict access to the OIDC logout endpoint to minimize the risk of exploitation. Avoid using the OIDC logout endpoint until the issue is resolved.

Fix

DoS

CSRF

Open Redirect

Weakness Enumeration

CWE-352

CWE-601

Related Identifiers

CVE-2020-10734

GHSA-RVJG-GXWX-J5GF

Affected Products

Keycloak

References · 9

• https://osv.dev/vulnerability/CVE-2020-10734 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1831662 · Vendor Advisory
• https://issues.redhat.com/browse/KEYCLOAK-13653 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rvjg-gxwx-j5gf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10734 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-rvjg-gxwx-j5gf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10734 · Note
• https://t.me/cibsecurity/23457 · Telegram Post