GitHub Advisoryadvisory · Maven

GHSA-c597-f74m-jgc2 Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak

MEDIUM Published 2022-02-09 Modified 2021-04-01 Official page ↗
Aliases
CVE-2020-1758
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-295, CWE-297
Reviewed
2021-04-01

Affected packages

• Maven org.keycloak:keycloak-parent: < 10.0.0 → fixed in 10.0.0

Description

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Related

Alias · CVE (1)

  • CVE-2020-1758 A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using… vulnerability

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-297 Improper Validation of Certificate with Host Mismatch weakness

References