PatchTheCVEkeycloak vulnerabilities
Recent CVEs affecting keycloak products. 6 tracked.
keycloak has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2018-02-21. Highest priority: CVE-2017-7474 (score 61/100).
- CVE-2017-7474 CRITICAL 9.8 DOWNGRADE It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly
- CVE-2017-12161 HIGH 8.8 UPGRADE It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a
- CVE-2017-12159 HIGH 7.5 DOWNGRADE MITIGATE It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session
- CVE-2017-12158 MEDIUM 5.4 DOWNGRADE MITIGATE It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web res
- CVE-2014-3709 HIGH 8.8 UPGRADE The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows
- CVE-2014-3651 HIGH 7.5 UPGRADE JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption)
FAQ
How do I fix keycloak vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is keycloak being exploited right now?
None of the tracked keycloak CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which keycloak CVE should I patch first?
CVE-2017-7474 currently ranks highest (61/100): It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.