GitHub Advisoryadvisory · Maven

GHSA-6pmv-7pr9-cgrj Predictable password in Keycloak

CRITICAL Published 2020-04-15 Modified 2021-08-23 Official page ↗
Aliases
CVE-2020-1731
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-330, CWE-341
Reviewed
2020-04-15

Affected packages

• Maven org.keycloak:keycloak-core: < 8.0.2 → fixed in 8.0.2

Description

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.

Related

Alias · CVE (1)

  • CVE-2020-1731 A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random… vulnerability

Weakness · CWE (2)

  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-341 Predictable from Observable State weakness

References