Bug 1831662 (CVE-2020-10734)

Summary:	CVE-2020-10734 keycloak: OIDC logout endpoint CSRF
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aileenc, avibelli, bgeorges, chazlett, cmoulliard, dkreling, gmalinko, ikanello, janstey, jbalunas, jochrist, jpallich, jwon, lthon, pdrozd, pgallagh, pjindal, psampaio, rruss, sthorger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	keycloak 18.0.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1823476, 2026780

Description Guilherme de Almeida Suckevicz 2020-05-05 12:54:12 UTC

A vulnerability was found in keycloak in the way that the OIDC logout endpoint do not have CSRF protection.

Reference:
https://issues.redhat.com/browse/KEYCLOAK-13653

Comment 9 Paramvir jindal 2022-02-15 16:02:54 UTC

*** Bug 2026778 has been marked as a duplicate of this bug. ***