VDB
KO
MEDIUM 5.3

GHSA-j628-q885-8gr5

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

Quick fix

GHSA-j628-q885-8gr5 — org.keycloak:keycloak-services: upgrade to the fixed version with the command below. 

# pom.xml: bump <version>22.0.9</version> for org.keycloak:keycloak-services

Details

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection.

Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping us improve our security.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.keycloak:keycloak-services
Introduced in: 0 Fixed in: 22.0.9
Fix # pom.xml: bump <version>22.0.9</version> for org.keycloak:keycloak-services
Maven / org.keycloak:keycloak-services
Introduced in: 23.0.0 Fixed in: 23.0.5
Fix # pom.xml: bump <version>23.0.5</version> for org.keycloak:keycloak-services

References