REDHAT-BUG-1868591
First published: Thu Aug 13 2020(Updated: )
A vulnerability was found in keycloak, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers. References: <a href="https://issues.jboss.org/browse/KEYCLOAK-14090">https://issues.jboss.org/browse/KEYCLOAK-14090</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Keycloak | ||
| Eclipse Jetty |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-1868591?
The severity of REDHAT-BUG-1868591 is considered high due to the potential for security bypass using lowercase HTTP headers.
How do I fix REDHAT-BUG-1868591?
To fix REDHAT-BUG-1868591, you should apply the latest updates provided by Red Hat for Keycloak and Jetty that address this vulnerability.
Which versions of software are affected by REDHAT-BUG-1868591?
REDHAT-BUG-1868591 affects various releases of Red Hat Build of Keycloak and Eclipse Jetty that allow lowercase HTTP headers.
What types of attacks are possible due to REDHAT-BUG-1868591?
REDHAT-BUG-1868591 could allow attackers to bypass security checks by sending requests with lowercase HTTP headers.
Is there a workaround for REDHAT-BUG-1868591?
As of now, the recommended approach to mitigate REDHAT-BUG-1868591 is to implement header normalization or filtering before reaching the Gatekeeper.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-14359
- agent/severity
- agent/references
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/keycloak
- vendor/eclipse
- canonical/eclipse jetty