DirectorySecurity Advisories
Sign In
Security Advisories

CGA-gc9r-7467-m772

Published

Last updated

https://images.chainguard.dev/security/CGA-gc9r-7467-m772
Package

keycloak

Latest Update
Fixed
Fixed Version

25.0.6-r0

Aliases
  • GHSA-4xx7-2cx3-x473

Severity

7.7

High

CVSS V3

Summary

Duplicate Advisory: Keycloak SAML signature validation flaw

Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xgfv-xpx8-qhcr. This link is maintained to preserve external references.

Original Description

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images