org.keycloak:keycloak-ldap-federation 26.6.2

Direct Vulnerabilities

Known vulnerabilities in the org.keycloak:keycloak-ldap-federation package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Access Control Bypass Affected versions of this package are vulnerable to Access Control Bypass in `LDAPStorageProvider.searchLDAPByAttributes` through `LDAP_ENTRY_DN` lookups in `federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java`. A delegated administrator can retrieve and import directory entries outside the configured `usersDn` by sending a search request with a crafted `q=LDAP_ENTRY_DN:<dn>` value. This exposes account information from unauthorized parts of the LDAP directory and can cause those out-of-scope users to be imported into local storage. How to fix Access Control Bypass? Upgrade `org.keycloak:keycloak-ldap-federation` to version 26.4.14, 26.6.5, 26.7.1 or higher.	[,26.4.14)[26.6.0,26.6.5)[26.7.0,26.7.1)
M Improper Validation of Specified Quantity in Input Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the LDAP federation BER decoder. An attacker can cause the Java Virtual Machine to terminate and disrupt service availability by sending a malformed LDAP password-policy response during authentication. This is only exploitable if the LDAP user-storage provider is configured and the attacker has high privileges, such as a realm administrator or access to a compromised LDAP server. How to fix Improper Validation of Specified Quantity in Input? Upgrade `org.keycloak:keycloak-ldap-federation` to version 26.6.3 or higher.	[26.6.0,26.6.3)

Vulnerability

Vulnerable Version

Access Control Bypass

Affected versions of this package are vulnerable to Access Control Bypass in LDAPStorageProvider.searchLDAPByAttributes through LDAP_ENTRY_DN lookups in federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java. A delegated administrator can retrieve and import directory entries outside the configured usersDn by sending a search request with a crafted q=LDAP_ENTRY_DN:<dn> value. This exposes account information from unauthorized parts of the LDAP directory and can cause those out-of-scope users to be imported into local storage.

How to fix Access Control Bypass?

Upgrade org.keycloak:keycloak-ldap-federation to version 26.4.14, 26.6.5, 26.7.1 or higher.

[,26.4.14)[26.6.0,26.6.5)[26.7.0,26.7.1)

Improper Validation of Specified Quantity in Input

Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the LDAP federation BER decoder. An attacker can cause the Java Virtual Machine to terminate and disrupt service availability by sending a malformed LDAP password-policy response during authentication. This is only exploitable if the LDAP user-storage provider is configured and the attacker has high privileges, such as a realm administrator or access to a compromised LDAP server.

How to fix Improper Validation of Specified Quantity in Input?

Upgrade org.keycloak:keycloak-ldap-federation to version 26.6.3 or higher.

[26.6.0,26.6.3)

org.keycloak:keycloak-ldap-federation@26.6.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically