Description
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | Fixed in 15.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7 +1 | 1-4.el7sso | RHBA-2022:5454, RHBA-2022:5452 |
| Red Hat Single Sign On 7 | rh-sso7-javapackages-tools +1 | 3.4.1-5.15.3.jbcs.el7 | RHBA-2022:5454, RHBA-2022:5452 |
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.0-2.redhat_00001.1.el7sso | RHBA-2022:5454, RHBA-2022:5452 |
| Red Hat Single Sign On 7 | rh-sso7-python3-javapackages | 3.4.1-5.15.6.el8sso | RHBA-2022:5454 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 15.1.0 | 15.1.0 | GHSA-3w4v-rvc4-2xpw |
Advisories 2
- RHBA-2022:5454 Red Hat Bug Fix Advisory: Red Hat Single Sign-On 7.6.0 update on RHEL 8 Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHBA-2022:5452 Red Hat Bug Fix Advisory: Red Hat Single Sign-On 7.6.0 update on RHEL 7 Red Hat Security Advisories (RHSA) · Sep 11, 2026