Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder um vertrauliche Informationen offenzulegen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 2
-
Medium 6.5
Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers
A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes t…
-
Medium 4.9
Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables
A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders lik…
Revision history
-
#2
Neue Updates von HITACHI aufgenommen
-
#1
Initiale Fassung
References
-
Keycloak Releasenotes vom 2025-01-13
https://www.keycloak.org/2025/01/keycloak-2608-released
-
Red Hat Security Advisory vom 2025-01-13
https://access.redhat.com/errata/RHSA-2025:0299
-
Red Hat Security Advisory vom 2025-01-13
https://access.redhat.com/errata/RHSA-2025:0300
-
GitHub Advisory Database vom 2025-01-13
https://github.com/advisories/GHSA-w3g8-r9gw-qrh8
-
GitHub Advisory Database vom 2025-01-13
https://github.com/advisories/GHSA-f4v7-3mww-9gc2
-
Hitachi Vulnerability Information HITACHI-SEC-2025-113 vom 2025-05-15
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-113/index.html