CVE-2021-3632: High severity red hat keycloak vulnerability
A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
Other sources
Anyone can register a new device when there is no device registered for passwordless login for any user.
https://issues.redhat.com/browse/KEYCLOAK-18500
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3632?
CVE-2021-3632 is a vulnerability in Keycloak that allows anyone to register a new security device or key using the WebAuthn password-less login flow.
What is the severity of CVE-2021-3632?
The severity of CVE-2021-3632 is high with a severity value of 7.5.
Which software versions are affected by CVE-2021-3632?
CVE-2021-3632 affects versions 0:9.0.15-1.redhat_00002.1.el6, 0:9.0.15-1.redhat_00002.1.el7, and 0:9.0.15-1.redhat_00002.1.el8 of rh-sso7-keycloak on Red Hat Enterprise Linux.
How can I fix CVE-2021-3632?
To fix CVE-2021-3632, update rh-sso7-keycloak to a version higher than 0:9.0.15-1.redhat_00002.1.el6, 0:9.0.15-1.redhat_00002.1.el7, or 0:9.0.15-1.redhat_00002.1.el8.
Where can I find more information about CVE-2021-3632?
You can find more information about CVE-2021-3632 at the following references: [1] [2] [3].