REDHAT-BUG-1778259: High severity keycloak vulnerability
Published Nov 29, 2019
·Updated
A bug exists in Keycloak 7.x where the user federation LDAP bind type is "none" (LDAP anonymous bind), any password, invalid or valid will be accepted
Mitigation: If the LDAP service supports "simple" use that method instead
Affected Software
1 affected component
Red Hat Keycloak>=7.0.0
Event History
Nov 29, 2019
Data Sourced
04:22 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-1778259?
The severity of REDHAT-BUG-1778259 is considered to be high due to the potential for unauthorized access.
2
How do I fix REDHAT-BUG-1778259?
To fix REDHAT-BUG-1778259, configure the LDAP service to use 'simple' bind instead of 'none'.
3
Which versions of Keycloak are affected by REDHAT-BUG-1778259?
Keycloak versions 7.x starting from 7.0.0 are affected by REDHAT-BUG-1778259.
4
What is the impact of REDHAT-BUG-1778259?
The impact of REDHAT-BUG-1778259 is that it allows any password, valid or invalid, to be accepted due to LDAP anonymous binding.
5
What is the recommended mitigation for REDHAT-BUG-1778259?
The recommended mitigation for REDHAT-BUG-1778259 is to avoid LDAP anonymous binding and use a secure bind method instead.