Nixpkgs security tracker
Untriaged
Permalink
CVE-2024-4540
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
References
Affected products
keycloak
- *
keycloak-core
rh-sso7-keycloak
- *
rhbk/keycloak-rhel9
- *
rhbk/keycloak-rhel9-operator
- *
rhbk/keycloak-operator-bundle
- *
rh-sso-7/sso76-openshift-rhel8
- *
Matching in nixpkgs
pkgs.keycloak
Identity and access management for modern applications and services
pkgs.terraform-providers.keycloak
None
pkgs.python311Packages.python-keycloak
Provides access to the Keycloak API
pkgs.python312Packages.python-keycloak
Provides access to the Keycloak API
pkgs.python313Packages.python-keycloak
Provides access to the Keycloak API
Package maintainers
-
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@NickCao Nick Cao <nickcao@nichi.co>