~ / search / GHSA-4fgq-gq9g-3rw7

GHSA-4fgq-gq9g-3rw7

Improper Verification of Cryptographic Signature in keycloak

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10201

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-core < 7.0.0 7.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

References

External links from the advisory. They lead to third-party sites.