A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1868591 | Issue Tracking Vendor Advisory |
| https://issues.jboss.org/browse/KEYCLOAK-14090 | Issue Tracking Permissions Required Third Party Advisory |
Configurations
History
10 Aug 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers. |
22 Jun 2021, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://issues.jboss.org/browse/KEYCLOAK-14090 - Issue Tracking, Permissions Required, Third Party Advisory | |
| CPE | cpe:2.3:a:redhat:louketo_proxy:*:*:*:*:*:*:*:* |
27 Feb 2021, 04:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 7.3 |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1868591 - Issue Tracking, Vendor Advisory | |
| References | (MISC) https://issues.jboss.org/browse/KEYCLOAK-14090 - Issue Tracking, Third Party Advisory |
23 Feb 2021, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-02-23 13:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-14359
Mitre link : CVE-2020-14359
CVE.ORG link : CVE-2020-14359
JSON object : View
Products Affected
redhat
- louketo_proxy
CWE
CWE-305
Authentication Bypass by Primary Weakness