REDHAT-BUG-2547296: Medium severity Red Hat Keycloak vulnerability
A Cleartext Transmission of Sensitive Information vulnerability was found in the keycloak-services component. The issue exists in the SMTP configuration handling where setting starttls=true results in opportunistic TLS rather than mandatory TLS. An active Man-in-the-Middle attacker can strip the STARTTLS capability from the SMTP server response during the EHLO exchange. Because Keycloak does not enforce the upgrade to TLS, it proceeds to fall back to an unencrypted plaintext connection. This allows the attacker to capture SMTP authentication credentials and the full content of email messages transmitted by the server.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be able to actively intercept the SMTP connection and modify the SMTP server's EHLO response to remove the advertised STARTTLS capability.
Which deployments are exposed?
Deployments using the keycloak-services SMTP configuration with starttls=true are exposed because that setting uses opportunistic rather than mandatory TLS.
What information could be exposed if exploitation succeeds?
An attacker can capture SMTP authentication credentials and the complete contents of email messages sent through the downgraded plaintext connection.