Homepage
About Snyk

org.keycloak:keycloak-saml-core@2.5.0.Final vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.keycloak:keycloak-saml-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Verification of Cryptographic Signature

org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the flawed SAML signature validation method in the XMLSignatureUtil class. An attacker can escalate privileges or impersonate another user by crafting responses that bypass the validation process.

How to fix Improper Verification of Cryptographic Signature?

Upgrade org.keycloak:keycloak-saml-core to version 22.0.13, 24.0.8, 25.0.6 or higher.

[,22.0.13) [23.0.0,24.0.8) [25.0.0,25.0.6)
  • M
Improper Verification of Cryptographic Signature

org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature improper validation logic in the signature validation method, which relies on the position of signatures rather than explicitly checking the referenced elements. An attacker can escalate privileges or impersonate another user by crafting responses that bypass the signature validation. This facilitates unauthorized access to high-privileged accounts in SAML-based identity providers and service providers.

How to fix Improper Verification of Cryptographic Signature?

Upgrade org.keycloak:keycloak-saml-core to version 22.0.13, 24.0.8, 25.0.6 or higher.

[,22.0.13) [23.0.0,24.0.8) [25.0.0,25.0.6)
  • H
Arbitrary Code Execution

org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak.

Affected versions of this package are vulnerable to Arbitrary Code Execution. It allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled. An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled.

How to fix Arbitrary Code Execution?

Upgrade org.keycloak:keycloak-saml-core to version 19.0.2 or higher.

[,19.0.2)
  • M
Information Exposure

org.keycloak:keycloak-saml-core is an Open Source Identity and Access Management For Modern Applications and Services.

Affected versions of this package are vulnerable to Information Exposure. While parsing SAML messages, the StaxParserUtil class replaced special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the InResponseTo field in the response.

How to fix Information Exposure?

Upgrade org.keycloak:keycloak-saml-core to version 2.5.1 or higher.

[,2.5.1.Final)
  • M
Information Exposure

org.keycloak:keycloak-saml-core is an open Source Identity and Access Management for modern Applications and Services.

Affected versions of the package are vulnerable to Information Exposure. In certain cases, the SAML request parser replaces special strings with system properties.

How to fix Information Exposure?

Upgrade org.keycloak:keycloak-saml-core to version 2.5.1.Final or higher.

[,2.5.1.Final)
  • H
Denial of Service (DoS)

org.keycloak:keycloak-saml-core Affected versions of this package are vulnerable to Denial of Service (DoS) attacks. It mishandles Logout requests that contain an Extension element, which triggers an infinite loop.

[1.2.0.Final,2.5.5.Final)
Go back to all versions of this package