CVE-2016-8629
First published: Wed Oct 26 2016(Updated: )
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/keycloak | <2.4.0 | 2.4.0 |
| Red Hat Keycloak | <2.4.0 | |
| Red Hat Single Sign-On | =7.1 | |
| Red Hat Single Sign-On | =7.2 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2017-0876.html
- http://www.securityfocus.com/bid/97392
- http://www.securitytracker.com/id/1038180
- https://access.redhat.com/errata/RHSA-2017:0872
- https://access.redhat.com/errata/RHSA-2017:0873
- https://bugzilla.redhat.com/show_bug.cgi?id=1388988
- https://issues.jboss.org/browse/KEYCLOAK-3667
- https://access.redhat.com/errata/RHSA-2017:0876
Frequently Asked Questions
What is the severity of CVE-2016-8629?
CVE-2016-8629 is rated as a high severity vulnerability due to its potential for unauthorized user deletion.
How do I fix CVE-2016-8629?
To fix CVE-2016-8629, upgrade Red Hat Keycloak to version 2.4.0 or later.
What types of systems are affected by CVE-2016-8629?
CVE-2016-8629 affects Red Hat Keycloak versions before 2.4.0 and Red Hat Single Sign-On versions 7.1 and 7.2.
Can CVE-2016-8629 be exploited remotely?
Yes, CVE-2016-8629 can be exploited remotely by an attacker with service account authentication.
What are the consequences of an exploit of CVE-2016-8629?
Exploiting CVE-2016-8629 allows an attacker to bypass permissions and delete users across different realms.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-8629
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/redhat
- canonical/red hat keycloak
- canonical/red hat single sign-on
- version/red hat single sign-on/7.1
- version/red hat single sign-on/7.2
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0