Bug 1812514 (CVE-2020-1758) - CVE-2020-1758 keycloak: improper verification of certificate with host mismatch could result in information disclosure
Summary: CVE-2020-1758 keycloak: improper verification of certificate with host mismat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-1758
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1812517
TreeView+ depends on / blocked
 
Reported: 2020-03-11 13:37 UTC by Michael Kaplan
Modified: 2021-02-16 20:28 UTC (History)
34 users (show)

Fixed In Version: keycloak 10.0.0
Clone Of:
Environment:
Last Closed: 2020-05-12 22:32:08 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2106 0 None None None 2020-05-12 16:40:15 UTC
Red Hat Product Errata RHSA-2020:2107 0 None None None 2020-05-12 16:39:49 UTC
Red Hat Product Errata RHSA-2020:2108 0 None None None 2020-05-12 16:40:31 UTC
Red Hat Product Errata RHSA-2020:2112 0 None None None 2020-05-12 17:17:35 UTC

Description Michael Kaplan 2020-03-11 13:37:09 UTC 
Keycloak does not perform TLS hostname verification when sending emails via an SMTP server which could result in information disclosure.

External Reference:

https://issues.redhat.com/browse/KEYCLOAK-13285
Comment 3 Paramvir jindal 2020-03-12 06:55:47 UTC 
Mitigation:

Turn off all kinds of email notifications including password reset mails.
Comment 7 errata-xmlrpc 2020-05-12 16:39:47 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 7

Via RHSA-2020:2107 https://access.redhat.com/errata/RHSA-2020:2107
Comment 8 errata-xmlrpc 2020-05-12 16:40:13 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 6

Via RHSA-2020:2106 https://access.redhat.com/errata/RHSA-2020:2106
Comment 9 errata-xmlrpc 2020-05-12 16:40:28 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3 for RHEL 8

Via RHSA-2020:2108 https://access.redhat.com/errata/RHSA-2020:2108
Comment 10 errata-xmlrpc 2020-05-12 17:17:33 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign On 7.3.8

Via RHSA-2020:2112 https://access.redhat.com/errata/RHSA-2020:2112
Comment 11 Product Security DevOps Team 2020-05-12 22:32:08 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-1758
Comment 13 Paramvir jindal 2020-05-18 14:05:29 UTC 
Acknowledgments:

Name: Peter Stöckli
Note You need to log in before you can comment on or make changes to this bug.