Bug 2160585 (CVE-2023-0264)

Summary:	CVE-2023-0264 keycloak: user impersonation via stolen uuid code
Product:	[Other] Security Response	Reporter:	Chess Hazlett <chazlett>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, fjuma, gzaronik, ivassile, iweiss, lgao, mokumar, mosmerov, msochure, msvehla, nwallace, pdrozd, pjindal, pmackay, pskopek, rstancel, security-response-team, smaestri, sthorger, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	keycloak 18.0.6	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Keycloak's OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-02 01:51:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2160548

Description Chess Hazlett 2023-01-12 23:10:58 UTC

Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.

Comment 3 errata-xmlrpc 2023-03-01 21:44:14 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 7

Via RHSA-2023:1043 https://access.redhat.com/errata/RHSA-2023:1043

Comment 4 errata-xmlrpc 2023-03-01 21:46:44 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 8

Via RHSA-2023:1044 https://access.redhat.com/errata/RHSA-2023:1044

Comment 5 errata-xmlrpc 2023-03-01 21:49:10 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.6 for RHEL 9

Via RHSA-2023:1045 https://access.redhat.com/errata/RHSA-2023:1045

Comment 6 errata-xmlrpc 2023-03-01 21:50:07 UTC

This issue has been addressed in the following products:

  RHEL-8 based Middleware Containers

Via RHSA-2023:1047 https://access.redhat.com/errata/RHSA-2023:1047

Comment 7 errata-xmlrpc 2023-03-01 22:00:14 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2023:1049 https://access.redhat.com/errata/RHSA-2023:1049

Comment 8 Product Security DevOps Team 2023-03-02 01:51:55 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-0264