Adapter: Open redirect vulnerability in checkSSO
Published Mar 27, 2023
6.8
MEDIUMCVSS 3.1
EPSS 0.40%
Description
A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.
Affected products
- Vendor n/a Product Keycloak Defaultn/a
- Version unknownStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Keycloak | n/a |
|
- n/a
- 7.0
No data.
Red Hat Single Sign-On 7
keycloak-js-adapter
Fixed · RHSA-2023:1049
Red Hat AMQ Broker 7
keycloak-adapter-core
Not affected
Red Hat Decision Manager 7
keycloak-adapter-core
Not affected
Red Hat Fuse 7
keycloak-adapter-core
Not affected
Red Hat Fuse 7
keycloak-core
Not affected
Red Hat OpenShift Container Platform 3.11
keycloak-adapter-core
Out of support scope
Red Hat Process Automation 7
keycloak-adapter-core
Not affected
Red Hat Satellite 6
keycloak-adapter-core
Not affected
Red Hat Single Sign-On 7
rh-sso7-keycloak
Not affected
Red Hat build of Quarkus
keycloak-adapter-core
Not affected
Red Hat support for Spring Boot
keycloak-adapter-core
Not affected
Red Hat support for Spring Boot
keycloak-core
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Single Sign-On 7 | keycloak-js-adapter | Fixed | RHSA-2023:1049 |
| Red Hat AMQ Broker 7 | keycloak-adapter-core | Not affected | n/a |
| Red Hat Decision Manager 7 | keycloak-adapter-core | Not affected | n/a |
| Red Hat Fuse 7 | keycloak-adapter-core | Not affected | n/a |
| Red Hat Fuse 7 | keycloak-core | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | keycloak-adapter-core | Out of support scope | n/a |
| Red Hat Process Automation 7 | keycloak-adapter-core | Not affected | n/a |
| Red Hat Satellite 6 | keycloak-adapter-core | Not affected | n/a |
| Red Hat Single Sign-On 7 | rh-sso7-keycloak | Not affected | n/a |
| Red Hat build of Quarkus | keycloak-adapter-core | Not affected | n/a |
| Red Hat support for Spring Boot | keycloak-adapter-core | Not affected | n/a |
| Red Hat support for Spring Boot | keycloak-core | Not affected | n/a |
keycloak-connect
npm
Introduced 0 Fixed 21.0.1
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | keycloak-connect | 0 | 21.0.1 |
Remediation
Red Hat statement
CodeReady Studio is no longer supported. Therefore, this flaw will not be addressed in CodeReady Studio. Please see https://developers.redhat.com/articles/2022/04/18/announcement-red-hat-codeready-studio-reaches-end-life for more information.
References (7)
- https://access.redhat.com/security/cve/CVE-2022-2237 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2097007 Issue TrackingVendor Advisory
- https://github.com/advisories/GHSA-59fq-727j-hm3f Advisory
- https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21
- https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f
- https://nvd.nist.gov/vuln/detail/CVE-2022-2237
- https://www.cve.org/CVERecord?id=CVE-2022-2237
Change history (0)
No recorded changes yet.