Description
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714
https://github.com/keycloak/keycloak/pull/7053
Related Vulnerabilities
CVE-2020-27220 Vulnerability in maven package org.eclipse.hono:hono-adapter-amqp-vertx
CVE-2019-16552 Vulnerability in maven package com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger
CVE-2023-27603 Vulnerability in maven package org.apache.linkis:linkis-common
CVE-2022-24197 Vulnerability in maven package com.itextpdf:itext7-core
CVE-2023-40573 Vulnerability in maven package org.xwiki.platform:xwiki-platform-scheduler-api