Bug 1649870 (CVE-2019-14820) - CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs
Summary: CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14820
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1649873
TreeView+ depends on / blocked
 
Reported: 2018-11-14 16:34 UTC by Laura Pardo
Modified: 2020-12-15 15:39 UTC (History)
33 users (show)

Fixed In Version: keycloak 8.0.0
Doc Type: If docs needed, set a value
Doc Text:
It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Clone Of:
Environment:
Last Closed: 2019-10-15 00:51:13 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3044 0 None None None 2019-10-14 18:28:37 UTC
Red Hat Product Errata RHSA-2019:3045 0 None None None 2019-10-14 18:28:57 UTC
Red Hat Product Errata RHSA-2019:3046 0 None None None 2019-10-14 18:29:18 UTC
Red Hat Product Errata RHSA-2019:3048 0 None None None 2019-10-14 18:32:10 UTC
Red Hat Product Errata RHSA-2019:3049 0 None None None 2019-10-14 18:34:00 UTC
Red Hat Product Errata RHSA-2019:3050 0 None None None 2019-10-14 18:59:22 UTC
Red Hat Product Errata RHSA-2020:2067 0 None None None 2020-05-18 10:25:13 UTC

Description Laura Pardo 2018-11-14 16:34:10 UTC 
A flaw was found in keycloak. A keycloak adapter exposes internal endpoints in org.keycloak.constants.AdapterConstantsThe keycloak which can be invoked by appending the appropriate suffix (e.g. k_version) to any URL. This vulnerability might lead to an information exposure.
Comment 3 Joshua Padman 2019-06-11 02:31:21 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat Openshift Application Runtimes Spring Boot

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 4 Jason Shepherd 2019-08-08 04:41:16 UTC 
This vulnerability is out of security support scope for the following product:

 * Red Hat Mobile Application Platform

 Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details
Comment 9 errata-xmlrpc 2019-10-14 18:28:34 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 6

Via RHSA-2019:3044 https://access.redhat.com/errata/RHSA-2019:3044
Comment 10 errata-xmlrpc 2019-10-14 18:28:55 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 7

Via RHSA-2019:3045 https://access.redhat.com/errata/RHSA-2019:3045
Comment 11 errata-xmlrpc 2019-10-14 18:29:15 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 8

Via RHSA-2019:3046 https://access.redhat.com/errata/RHSA-2019:3046
Comment 12 errata-xmlrpc 2019-10-14 18:32:08 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2019:3048 https://access.redhat.com/errata/RHSA-2019:3048
Comment 13 errata-xmlrpc 2019-10-14 18:33:58 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2019:3049 https://access.redhat.com/errata/RHSA-2019:3049
Comment 14 errata-xmlrpc 2019-10-14 18:59:20 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3.4 zip

Via RHSA-2019:3050 https://access.redhat.com/errata/RHSA-2019:3050
Comment 15 Product Security DevOps Team 2019-10-15 00:51:13 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14820
Comment 17 errata-xmlrpc 2020-05-18 10:25:07 UTC 
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067
Note You need to log in before you can comment on or make changes to this bug.