CVE-2020-1717

[canon-cmre-benoit-lecardonnel]

Hello,

Our instance of Dependency-Track has flagged the keycloak-services 23.0.7 JAR: it says it's impacted by CVE-2020-1717.
There is little info available online about this CVE, so not sure whether it is still valid for recent KC versions.
Maybe there is some info at https://issues.redhat.com/browse/KEYCLOAK-12014, but I cannot access that page.

Do you know about this CVE? Does it still impact KC 23.0.7?

Thanks,
Ben

[abstractj]

@canon-cmre-benoit-lecardonnel CVE-2020-1717 is a vulnerability found in Keycloak version 7.0.1, actually we are at Keycloak 24.0.2. We strongly advise our users to upgrade, so they can benefit from the security updates.

[jonkoops]

Still upgrade to Keycloak 24 if you want to be secure, we don't support versions of Keycloak other than the current major.

[canon-cmre-steve-magness]

So was this vulnerability specifically fixed in Keycloak v24 and versions v7 through v23 are exposed, or was it fixed during/after v7 and v23 is not exposed? Trying to determine if it is a False Positive for v23 given the CVE only mentions v7.0.1 specifically.

I appreciate we should still upgrade to Keycloak 24 eventually, but that's not quite what is being asked.

[abstractj]

User enumeration is considered a weakness by our team considering that there are several ways if of mitigating this issue. The CVE mentioned, from what I checked, reported on Keycloak 7 and due to the agreement of handling it as a weakness was not fixed.

For the list of issues around this topic, please check https://github.com/keycloak/keycloak/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+user+enumeration.

[canon-cmre-benoit-lecardonnel]

there are several ways if of mitigating this issue.

Can you explain what the mitigations are for this issue? I'd like to check we have them in place in our installations.

Thanks

[codespearhead]

A more straightforward report of this CVE can be found here.

As explained in #17629 , this type of brute force attack in particular will only affect Keycloak if there's no WAF in front of it doing its part.