Homepage

org.keycloak:keycloak-common@6.0.1 vulnerabilities

  • latest version

    26.2.5

  • latest non vulnerable version

    26.2.5

  • first published

    9 years ago

  • latest version published

    1 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.keycloak:keycloak-common package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Exposure of Sensitive Information Through Environmental Variables

    org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.

    Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Environmental Variables through user-configurable URLs.

    Exploiting this vulnerability is possible with the configuration of backchannel logout URLs or admin URLs, when including placeholders like ${env.VARNAME} or ${PROPNAME}, which are replaced with actual values during URL processing. An attacker can access sensitive server environment variables and system properties.

    How to fix Exposure of Sensitive Information Through Environmental Variables?

    Upgrade org.keycloak:keycloak-common to version 26.0.8 or higher.

    [,26.0.8)
    • M
    HTTP Request Smuggling

    org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.

    Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of proxy headers resulting in costly DNS resolution operations. An attacker could tie up IO threads and potentially cause a denial of service by exploiting these operations.

    Notes:

    1. This is only exploitable if the attacker has access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.

    2. For versions 26.x, this is only exploitable if the realm must have SslRequired=EXTERNAL (the default), HTTP must be enabled, the instance must not be using a full hostname URL, access must come from behind a proxy (assuming the proxy overwrites the X-Forwarded-For header), and trusted proxies must not be set or must incorrectly trust the client from which the request is originating.

    How to fix HTTP Request Smuggling?

    Upgrade org.keycloak:keycloak-common to version 26.0.6 or higher.

    [,26.0.6)
    • M
    Open Redirect

    org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.

    Affected versions of this package are vulnerable to Open Redirect due to improper validation of redirect URIs using the form_post.jwt response mode. An attacker can redirect a user to a malicious site and potentially steal authorization codes or tokens by exploiting the use of a wildcard in the JARM response.

    How to fix Open Redirect?

    Upgrade org.keycloak:keycloak-common to version 23.0.4 or higher.

    [,23.0.4)
    • H
    Remote Code Execution (RCE)

    org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.

    Affected versions of this package are vulnerable to Remote Code Execution (RCE). It contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects.

    How to fix Remote Code Execution (RCE)?

    Upgrade org.keycloak:keycloak-common to version 11.0.0 or higher.

    [0,11.0.0)
    Go back to all versions of this package