Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2023-6484
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 8 months ago
Keycloak: log injection during webauthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

References

Affected products

keycloak
  • <22.0.9
  • <23.0.5
rh-sso7-keycloak
  • *
rhbk/keycloak-rhel9
  • *
keycloak-rhel9-container
rh-sso-7/sso7-rhel8-operator
  • *
rhbk/keycloak-rhel9-operator
  • *
rhbk/keycloak-operator-bundle
  • *
rh-sso-7/sso76-openshift-rhel8
  • *
Red Hat build of Keycloak 22.0.10
keycloak-rhel9-operator-container
rh-sso-7/sso7-rhel8-init-container
  • *
rh-sso-7/sso7-rhel8-operator-bundle
  • *
keycloak-rhel9-operator-bundle-container

Matching in nixpkgs

pkgs.keycloak

Identity and access management for modern applications and services

Package maintainers