Arch Linux Security Advisory ASA-202105-6

Severity: High
Date    : 2021-05-19
CVE-ID  : CVE-2020-14302 CVE-2020-27838 CVE-2021-3513 CVE-2021-20202
Package : keycloak
Type    : multiple issues
Remote  : Yes
Link    :


The package keycloak before version 13.0.0-1 is vulnerable to multiple
issues including cross-site scripting, information disclosure and
insufficient validation.


Upgrade to 13.0.0-1.

# pacman -Syu "keycloak>=13.0.0-1"

The problems have been fixed upstream in version 13.0.0.




- CVE-2020-14302 (insufficient validation)

A flaw was found in Keycloak before 13.0.0 where an external identity
provider, after successful authentication, redirects to a Keycloak
endpoint that accepts multiple invocations with the use of the same
"state" parameter. This flaw allows a malicious user to perform replay

- CVE-2020-27838 (information disclosure)

A security issue was found in keycloak in versions prior to 13.0.0. The
client registration endpoint allows fetching information about PUBLIC
clients (like client secret) without authentication which could be an
issue if the same PUBLIC client changed to CONFIDENTIAL later.

- CVE-2021-3513 (information disclosure)

A security issue was found in keycloak before version 13.0.0 where
brute force attacks are possible even when the permanent lockout
feature is enabled because of the wrong error message that is displayed
when wrong credentials are entered.

- CVE-2021-20202 (information disclosure)

A security issue was found in keycloak before version 13.0.0.
Directories can be created prior to the Java process creating them in
the temporary directory, but with wider user permissions, allowing the
attacker to have access to the contents that keycloak stores in this

- CVE-2021-20222 (cross-site scripting)

A security issue was found in keycloak before version 13.0.0. The new
account console in keycloak can allow malicious code to be executed
using the referrer URL.


A remote attacker could perform replay attacks, obtain information
about CONFIDENTIAL clients, brute force account credentials, or execute
arbitrary code through cross-site scripting. A local attacker could
access sensitive information stored in temporary directories.