CVE-2019-14909
First published: Fri Nov 29 2019(Updated: )
A bug exists in Keycloak 7.x where the user federation LDAP bind type is "none" (LDAP anonymous bind), any password, invalid or valid will be accepted Mitigation: If the LDAP service supports "simple" use that method instead
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Keycloak | =7.0.0 | |
| Redhat Keycloak | =7.0.1 |
Remedy
Use bindType:Simple
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Keycloak vulnerability?
The vulnerability ID is CVE-2019-14909.
What is the severity of CVE-2019-14909?
The severity of CVE-2019-14909 is high.
What is the affected software for CVE-2019-14909?
The affected software for CVE-2019-14909 is Keycloak 7.x.
What is the description of CVE-2019-14909?
CVE-2019-14909 is a vulnerability in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
How can I fix CVE-2019-14909?
To fix CVE-2019-14909, it is recommended to update to a version of Keycloak that is not impacted by the vulnerability.
- collector/github-advisory-latest
- alias/GHSA-fv4q-wm8c-wjg4
- alias/CVE-2019-14909
- collector/github-advisory
- collector/redhat-cve
- collector/redhat-bugzilla
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/event
- agent/remedy
- agent/first-publish-date
- agent/weakness
- agent/description
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/maven
- vendor/redhat
- canonical/redhat keycloak
- version/redhat keycloak/7.0.0
- version/redhat keycloak/7.0.1