REDHAT-BUG-1868591: Medium severity keycloak vulnerability

Published Aug 13, 2020

Updated

A vulnerability was found in keycloak, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.

References: https://issues.jboss.org/browse/KEYCLOAK-14090

Affected Software

2 affected components

Red Hat Keycloak

Eclipse Jetty

Event History

Aug 13, 2020

Data Sourced

via Red Hat·08:33 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1868591?

The severity of REDHAT-BUG-1868591 is considered high due to the potential for security bypass using lowercase HTTP headers.

How do I fix REDHAT-BUG-1868591?

To fix REDHAT-BUG-1868591, you should apply the latest updates provided by Red Hat for Keycloak and Jetty that address this vulnerability.

Which versions of software are affected by REDHAT-BUG-1868591?

REDHAT-BUG-1868591 affects various releases of Red Hat Build of Keycloak and Eclipse Jetty that allow lowercase HTTP headers.

What types of attacks are possible due to REDHAT-BUG-1868591?

REDHAT-BUG-1868591 could allow attackers to bypass security checks by sending requests with lowercase HTTP headers.

Is there a workaround for REDHAT-BUG-1868591?

As of now, the recommended approach to mitigate REDHAT-BUG-1868591 is to implement header normalization or filtering before reaching the Gatekeeper.