keycloak-core discloses system properties

Also known as GHSA-c77r-6f64-478q

Published 8 y ago 2018-07-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

2.4%

percentile 84%

Public exploits

none known

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.

Exploit prediction (EPSS)

2.43% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:P/I:N/A:N`
GitHub	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.keycloak:keycloak-core`	<2.5.1	2.5.1

Affected products

Red Hat keycloak

Classification

Weakness

CWE-201 Insertion of Sensitive Information Into Sent Data
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

access.redhat.com /errata/RHSA-2017:3220 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:3216 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:2809 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:2740 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:3218 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:2810 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:2741 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:2742 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:2808 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2019:0137 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:3219 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2019:0139 · vendor-advisory, x_refsource_REDHAT, x_transferred
github.com /keycloak/keycloak/pull/3715/commits/0cb5ba0f6e83162d221681f47b470c3042eef237 · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1041707 · vdb-entry, x_refsource_SECTRACK, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2582 · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2019:0136 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:2743 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:3217 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:2811 · vendor-advisory, x_refsource_REDHAT, x_transferred
securityfocus.com /bid/101046 · vdb-entry, x_refsource_BID, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-2582 · advisory
github.com /advisories/GHSA-c77r-6f64-478q · advisory

Sources

CVE List: CVE-2017-2582
GitHub Advisory: GHSA-c77r-6f64-478q
NVD: CVE-2017-2582

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary