Bug 1705975 (CVE-2020-1714)
| Summary: | CVE-2020-1714 keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, avibelli, bgeorges, cbyrne, chazlett, clement.escoffier, cmacedo, cmoulliard, dandread, dffrench, dkreling, drieden, drusso, etirelli, ggaughan, gmalinko, gsmet, ibek, ikanello, janstey, jbalunas, jmadigan, jochrist, jpallich, jshepherd, jstastny, jwon, krathod, kverlaen, lthon, mnovotny, mszynkie, ngough, paradhya, pdrozd, pgallagh, pjindal, probinso, pwright, rfreire, rrajasek, rruss, rsvoboda, rsynek, sbiarozk, sdaley, sdouglas, security-response-team, sthorger, trepel |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | keycloak 11.0.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-07-02 13:27:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1705976 | ||
|
Description
Marian Rehak
2019-05-03 10:27:21 UTC
Red Hat Mobile application platform (RHMAP) does not make use of the Keycloak Kerberos 5 Delegated Authorization feature, which does the unsafe deserialization. The other usage of ObjectInputStream pointed out in KEYCLOAK-10162 is used for reading the KeycloakSecurityContext out of the HTTP cache in the application server, which doesn't pose a threat to RHMAP because it's not accepting user input to be deserialized. This vulnerability is out of security support scope for the following product: * Red Hat Mobile Application Platform Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. Acknowledgments: Name: Thomas Darimont Mitigation: There is currently no known mitigation for this issue. This issue has been addressed in the following products: Red Hat Single Sign-On 7.4.1 Via RHSA-2020:2813 https://access.redhat.com/errata/RHSA-2020:2813 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-1714 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:2814 https://access.redhat.com/errata/RHSA-2020:2814 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Via RHSA-2020:2816 https://access.redhat.com/errata/RHSA-2020:2816 This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2020:2905 https://access.redhat.com/errata/RHSA-2020:2905 This issue has been addressed in the following products: Red Hat Runtimes Spring Boot 2.1.15 Via RHSA-2020:3017 https://access.redhat.com/errata/RHSA-2020:3017 This issue has been addressed in the following products: Red Hat Decision Manager Via RHSA-2020:3675 https://access.redhat.com/errata/RHSA-2020:3675 This issue has been addressed in the following products: Red Hat Process Automation Via RHSA-2020:3678 https://access.redhat.com/errata/RHSA-2020:3678 This issue has been addressed in the following products: Red Hat build of Quarkus 1.7.5 Via RHSA-2020:4252 https://access.redhat.com/errata/RHSA-2020:4252 This issue has been addressed in the following products: Red Hat Fuse 7.8.0 Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568 |