Description

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714

https://github.com/keycloak/keycloak/pull/7053

Related Vulnerabilities

CVE-2022-38900 Vulnerability in maven package org.webjars.bowergithub.samverschueren:decode-uri-component

CVE-2019-10241 Vulnerability in maven package org.eclipse.jetty.aggregate:jetty-all-server

CVE-2023-26487 Vulnerability in maven package org.webjars.npm:vega-functions

CVE-2023-4853 Vulnerability in maven package io.quarkus:quarkus-keycloak-authorization

CVE-2023-47324 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Vendor Advisory Patch Third Party Advisory