Description
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714
https://github.com/keycloak/keycloak/pull/7053
Related Vulnerabilities
CVE-2023-40816 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2022-47042 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2019-1003032 Vulnerability in maven package org.jenkins-ci.plugins:email-ext
CVE-2021-36749 Vulnerability in maven package org.apache.druid:druid-core
CVE-2023-29508 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livedata-macro