GitHub Advisoryadvisory · Maven

GHSA-4fgq-gq9g-3rw7 Improper Verification of Cryptographic Signature in keycloak

MEDIUM Published 2019-09-23 Modified 2021-04-01 Official page ↗
Aliases
CVE-2019-10201
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-347
Reviewed
2019-09-19

Affected packages

• Maven org.keycloak:keycloak-core: < 7.0.0 → fixed in 7.0.0

Description

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

Related

Alias · CVE (1)

  • CVE-2019-10201 It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References