Keycloak: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 8.2
  CVE-2022-41966 Public exploit

  XStream Denial of Service via stack overflow

  XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…

  x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  Dec 27, 2022
• High 7.5
  CVE-2022-25857

  Denial of Service (DoS)

  The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

  management-api-for-apache-cassandra-5.0 management-api-for-apache-cassandra-5.0-compat org.yaml:snakeyaml snakeyaml Debian Ubuntu Wolfi Maven
  Aug 30, 2022
• Medium 6.5
  CVE-2022-40151

  Stack Buffer Overflow in xstream

  Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial o…

  x-stream xstream com.thoughtworks.xstream:xstream libxstream-java Debian Ubuntu Maven
  Sep 16, 2022
• Low 3.8
  CVE-2023-0091

  Keycloak has lack of validation of access token on client registrations endpoint

  A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

  redhat.com Keycloak org.keycloak:keycloak-core Maven
  Jan 11, 2023

Revision history

1. 2026-01-25 #18

   Neue Updates von Dell aufgenommen

2. 2025-09-21 #17

   Neue Updates von IBM aufgenommen

3. 2024-03-17 #16

   Neue Updates von Red Hat aufgenommen

4. 2024-02-19 #15

   Neue Updates von Amazon aufgenommen

5. 2023-07-06 #14

   Neue Updates von IBM aufgenommen

6. 2023-06-29 #13

   Neue Updates von IBM und Red Hat aufgenommen

7. 2023-06-28 #12

   Neue Updates von IBM aufgenommen

8. 2023-06-27 #11

   Neue Updates von IBM aufgenommen

9. 2023-06-21 #10

   Neue Updates von IBM aufgenommen

10. 2023-05-24 #9

    Neue Updates von Red Hat aufgenommen

11. 2023-05-22 #8

    Neue Updates von HITACHI aufgenommen

12. 2023-04-05 #7

    Neue Updates von Amazon aufgenommen

13. 2023-03-29 #6

    Neue Updates von SUSE aufgenommen

14. 2023-03-16 #5

    Neue Updates von Red Hat aufgenommen

15. 2023-03-09 #4

    Neue Updates von Red Hat aufgenommen

16. 2023-03-08 #3

    Neue Updates von Red Hat aufgenommen

17. 2023-03-01 #2

    Neue Updates von Red Hat aufgenommen

18. 2023-01-12 #1

    Initiale Fassung

References

• Keycloak 20.0.3 Release vom 2023-01-12
  https://www.keycloak.org/2023/01/keycloak-2003-released
• Github Advisory Database vom 2023-01-12
  https://github.com/advisories/GHSA-v436-q368-hvgg
• Github Advisory Database vom 2023-01-12
  https://github.com/advisories/GHSA-3mc7-4q67-w48m
• Red Hat Security Advisory RHSA-2023:1045 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1045
• Red Hat Security Advisory RHSA-2023:1044 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1044
• Red Hat Security Advisory RHSA-2023:1049 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1049
• Red Hat Security Advisory RHSA-2023:1043 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1043
• Red Hat Security Advisory RHSA-2023:1047 vom 2023-03-02
  https://access.redhat.com/errata/RHSA-2023:1047
• Red Hat Security Advisory RHSA-2023:1006 vom 2023-03-09
  https://access.redhat.com/errata/RHSA-2023:1006
• Red Hat Security Advisory RHSA-2023:1177 vom 2023-03-09
  https://access.redhat.com/errata/RHSA-2023:1177
• Red Hat Security Advisory RHSA-2023:1286 vom 2023-03-16
  https://access.redhat.com/errata/RHSA-2023:1286
• SUSE Security Update SUSE-SU-2023:1673-1 vom 2023-03-29
  https://lists.suse.com/pipermail/sle-security-updates/2023-March/014243.html
• Amazon Linux Security Advisory ALAS-2023-2007 vom 2023-04-05
  https://alas.aws.amazon.com/AL2/ALAS-2023-2007.html
• Hitachi Software Vulnerability Information hitachi-sec-2023-116 vom 2023-05-23
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-116/index.html
• Red Hat Security Advisory RHSA-2023:3299 vom 2023-05-24
  https://access.redhat.com/errata/RHSA-2023:3299
• IBM Security Bulletin 7005851 vom 2023-06-21
  https://www.ibm.com/support/pages/node/7005851
• IBM Security Bulletin 6852831 vom 2023-06-27
  https://www.ibm.com/support/pages/node/6852831
• IBM Security Bulletin 6852835 vom 2023-06-28
  https://www.ibm.com/support/pages/node/6852835
• IBM Security Bulletin 7008449 vom 2023-06-29
  https://www.ibm.com/support/pages/node/7008449
• Red Hat Security Advisory RHSA-2023:3954 vom 2023-06-29
  https://access.redhat.com/errata/RHSA-2023:3954
• IBM Security Bulletin 7010099 vom 2023-07-06
  https://www.ibm.com/support/pages/node/7010099
• Amazon Linux Security Advisory ALAS-2024-2464 vom 2024-02-19
  https://alas.aws.amazon.com/AL2/ALAS-2024-2464.html
• Red Hat Security Advisory RHSA-2024:1353 vom 2024-03-18
  https://access.redhat.com/errata/RHSA-2024:1353
• IBM Security Bulletin 7245569 vom 2025-09-19
  https://www.ibm.com/support/pages/node/7245569
• Deell Security Update
  https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities