Improper Output Neutralization for Logs in Keycloak - CVE-2023-6484

Vulnerability identifier: #VU86549

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6484

CWE-ID: CWE-117

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to manipulate data in log files.

The vulnerability exists due to improper input validation during WebAuthn authentication or registration. A remote attacker can manipulate data in log files when using the WebAuthn authentication mode.

Keycloak
Red Hat Single Sign-On
rh-sso7-keycloak (Red Hat package)

Install updates from vendor's website.

Keycloak - addressed in versions 22.0.9, 23.0.5
Red Hat Single Sign-On - addressed in versions 7.6.7, 7.6.8
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.12-1.redhat_00001.1.el7sso, 18.0.12-1.redhat_00001.1.el8sso, 18.0.12-1.redhat_00001.1.el9sso, 18.0.13-1.redhat_00001.1.el7sso, 18.0.13-1.redhat_00001.1.el8sso, 18.0.13-1.redhat_00001.1.el9sso

• https://bugzilla.redhat.com/show_bug.cgi?id=2248423
• https://github.com/keycloak/keycloak/security/advisories/GHSA-j628-q885-8gr5
• https://access.redhat.com/errata/RHSA-2024:1867
• https://access.redhat.com/errata/RHSA-2024:1868

• Log injection in Keycloak
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6