Read the docs
Red Hat Security Advisory

RHSA-2020:2252

Red Hat support for Spring Boot 2.2.6 security and bug fix update

Released 2020-06-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2020-01662 CVE-2020-1718 · GHSA-j229-2h63-rvh9

Improper authentication in Red Hat keycloak

Priority MEDIUM 40

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01004 Published 2020-05-12 Partial fix · 8.0.0 CWE-287
TI-2020-01671 CVE-2020-1727 · GHSA-pw23-237p-qf6r

Improper input validation in [UNKNOWN] keycloak

Priority LOW 30

A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00801 Published 2020-06-22 Partial fix · 9.0.2 CWE-20
TI-2020-01644 CVE-2020-1697 · GHSA-8vf3-4w62-m3pq

Cross-site scripting in Red Hat keycloak

Priority LOW 29

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00758 Published 2020-02-10 Partial fix · 9.0.0 CWE-79
TI-2020-01645 CVE-2020-1698 · GHSA-qgmm-f2qw-r95f

Information disclosure in Red Hat keycloak

Priority LOW 25

A flaw was found in keycloak in versions before 9.0.0.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00371 Published 2020-05-11 Partial fix · 9.0.0 CWE-200