<p>Upgrade <code>org.keycloak:keycloak-common</code> to version 11.0.0 or higher.</p>

Remote Code Execution (RCE) Affecting org.keycloak:keycloak-common package, versions [0,11.0.0)

Threat Intelligence

0.81% (83^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGKEYCLOAK-568921
published 13 May 2020
disclosed 11 May 2020
credit Thomas Darimont

Report a new vulnerability Found a mistake?

Introduced: 11 May 2020

CVE-2020-1714 Open this link in a new tab CWE-20 Open this link in a new tab CWE-94 Open this link in a new tab

How to fix?

Upgrade org.keycloak:keycloak-common to version 11.0.0 or higher.

Overview

org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). It contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

High
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

High