Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-xvv8-8wh9-9fh2
Advisory ID github_osv/GHSA-xvv8-8wh9-9fh2
Aliases CVE-2018-10894
Summary Keycloak Authentication Error It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
Status Published
Exploitability 0.5
Weighted Severity 4.9
Risk 2.5
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-295 Improper Certificate Validation
System Score Found at
cvssv3 5.4 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xvv8-8wh9-9fh2/GHSA-xvv8-8wh9-9fh2.json
generic_textual MODERATE
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2019:0877
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10894
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/812e76c39b1e693e8f11e5549cca2c90631f372e
CVE-2018-10894 https://nvd.nist.gov/vuln/detail/CVE-2018-10894
RHSA-2018:3592 https://access.redhat.com/errata/RHSA-2018:3592
RHSA-2018:3593 https://access.redhat.com/errata/RHSA-2018:3593
RHSA-2018:3595 https://access.redhat.com/errata/RHSA-2018:3595
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xvv8-8wh9-9fh2/GHSA-xvv8-8wh9-9fh2.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.