Bug 1649870 (CVE-2019-14820) - CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs
Summary: CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14820
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1649873
TreeView+ depends on / blocked
 
Reported: 2018-11-14 16:34 UTC by Laura Pardo
Modified: 2020-06-09 11:07 UTC (History)
33 users (show)

Fixed In Version: keycloak 8.0.0
Doc Type: If docs needed, set a value
Doc Text:
It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Clone Of:
Environment:
Last Closed: 2019-10-15 00:51:13 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:3044 None None None 2019-10-14 18:28:37 UTC
Red Hat Product Errata RHSA-2019:3045 None None None 2019-10-14 18:28:57 UTC
Red Hat Product Errata RHSA-2019:3046 None None None 2019-10-14 18:29:18 UTC
Red Hat Product Errata RHSA-2019:3048 None None None 2019-10-14 18:32:10 UTC
Red Hat Product Errata RHSA-2019:3049 None None None 2019-10-14 18:34:00 UTC
Red Hat Product Errata RHSA-2019:3050 None None None 2019-10-14 18:59:22 UTC
Red Hat Product Errata RHSA-2020:2067 None None None 2020-05-18 10:25:13 UTC

Description Laura Pardo 2018-11-14 16:34:10 UTC
A flaw was found in keycloak. A keycloak adapter exposes internal endpoints in org.keycloak.constants.AdapterConstantsThe keycloak which can be invoked by appending the appropriate suffix (e.g. k_version) to any URL. This vulnerability might lead to an information exposure.

Comment 3 Joshua Padman 2019-06-11 02:31:21 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat Openshift Application Runtimes Spring Boot

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 4 Jason Shepherd 2019-08-08 04:41:16 UTC
This vulnerability is out of security support scope for the following product:

 * Red Hat Mobile Application Platform

 Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details

Comment 9 errata-xmlrpc 2019-10-14 18:28:34 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 6

Via RHSA-2019:3044 https://access.redhat.com/errata/RHSA-2019:3044

Comment 10 errata-xmlrpc 2019-10-14 18:28:55 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 7

Via RHSA-2019:3045 https://access.redhat.com/errata/RHSA-2019:3045

Comment 11 errata-xmlrpc 2019-10-14 18:29:15 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 8

Via RHSA-2019:3046 https://access.redhat.com/errata/RHSA-2019:3046

Comment 12 errata-xmlrpc 2019-10-14 18:32:08 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2019:3048 https://access.redhat.com/errata/RHSA-2019:3048

Comment 13 errata-xmlrpc 2019-10-14 18:33:58 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2019:3049 https://access.redhat.com/errata/RHSA-2019:3049

Comment 14 errata-xmlrpc 2019-10-14 18:59:20 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3.4 zip

Via RHSA-2019:3050 https://access.redhat.com/errata/RHSA-2019:3050

Comment 15 Product Security DevOps Team 2019-10-15 00:51:13 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14820

Comment 17 errata-xmlrpc 2020-05-18 10:25:07 UTC
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067


Note You need to log in before you can comment on or make changes to this bug.