GHSA-C597-F74M-JGC2中危已审查

Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak

OSV 1.4.0 · github-reviewed · 修改于 2021-04-02 05:57

发布时间

2022-02-09 08:56

GitHub 审查时间

2021-04-02 05:57

NVD 发布时间

2020-05-16 03:15

源文件

advisories/github-reviewed/2022/02/GHSA-c597-f74m-jgc2/GHSA-c597-f74m-jgc2.json

公告说明

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

受影响的软件包

Maven

org.keycloak:keycloak-parent

ECOSYSTEM

引入0修复10.0.0

标识信息

别名 / CVE

CVE-2020-1758

CWE

CWE-295CWE-297

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-c597-f74m-jgc2",
  "aliases": [
    "CVE-2020-1758"
  ],
  "details": "A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.",
  "summary": "Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.0"
            }
          ]
        }
      ],
      "package": {
        "name": "org.keycloak:keycloak-parent",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2021-04-01T21:57:32Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2022-02-09T00:56:26Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1758",
      "type": "ADVISORY"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758",
      "type": "WEB"
    },
    {
      "url": "https://issues.redhat.com/browse/KEYCLOAK-13285",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-297"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2020-05-15T19:15:00Z",
    "github_reviewed_at": "2021-04-01T21:57:32Z"
  }
}