CVE-2020-27838
First published: Fri Dec 11 2020(Updated: )
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Keycloak | <13.0.0 | |
| Redhat Single Sign-on | =7.0 | |
| redhat/keycloak | <13.0.0 | 13.0.0 |
| maven/org.keycloak:keycloak-core | <13.0.0 | 13.0.0 |
| <13.0.0 | ||
| =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1906797
- https://issues.redhat.com/browse/KEYCLOAK-16521
- https://nvd.nist.gov/vuln/detail/CVE-2020-27838
- https://github.com/keycloak/keycloak/pull/7790
- https://github.com/keycloak/keycloak/commit/9356843c6c3d7097d010b3bb6f91e25fcaba378c
- https://github.com/advisories/GHSA-pcv5-m2wh-66j3 (Advisory)
Frequently Asked Questions
What is CVE-2020-27838?
CVE-2020-27838 is a vulnerability in Keycloak prior to version 13.0.0 that allows fetching information about PUBLIC clients without authentication.
How does CVE-2020-27838 affect Keycloak?
CVE-2020-27838 allows PUBLIC clients to access client secret information without authentication, which could be a problem if the same PUBLIC client is changed to CONFIDENTIAL later.
What is the severity of CVE-2020-27838?
CVE-2020-27838 has a severity rating of medium.
How can I fix CVE-2020-27838?
To fix CVE-2020-27838, update Keycloak to version 13.0.0 or later.
Where can I find more information about CVE-2020-27838?
You can find more information about CVE-2020-27838 at the following references: [reference 1](https://issues.redhat.com/browse/KEYCLOAK-16521) and [reference 2](https://bugzilla.redhat.com/show_bug.cgi?id=1906797).
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pcv5-m2wh-66j3
- alias/CVE-2020-27838
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/redhat-bugzilla
- source/Red Hat
- agent/event
- agent/tags
- collector/github-advisory
- vendor/redhat
- canonical/redhat keycloak
- canonical/redhat single sign-on
- version/redhat single sign-on/7.0
- package-manager/maven
- package-manager/redhat