PT-2024-5148 · Red Hat · Keycloak

Patrick Del Bello · Published 2024-04-17 · Updated 2024-07-05 · CVE-2023-6544

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Keycloak (affected versions not specified)

Description: A flaw was found in the Keycloak package due to a permissive regular expression hardcoded for filtering, which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-625

Related Identifiers

BDU:2024-05695

CVE-2023-6544

GHSA-46C8-635V-68R2

RHSA-2024:1860

RHSA-2024:1861

RHSA-2024:1862

Affected Products

Keycloak

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2023-6544 · Security Note
• https://access.redhat.com/errata/RHSA-2024:1867 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1866 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1860 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1861 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1868 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1864 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-46c8-635v-68r2 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1862 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05695 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-46c8-635v-68r2 · Note
• https://access.redhat.com/security/cve/CVE-2023-6544 · Note
• https://vuldb.com/?id.260949 · Note
• https://twitter.com/NUYTSTECH/status/1809288924843635068 · Twitter Post