Nixpkgs Security Tracker

Untriaged

Permalink CVE-2023-6484

created 5 months ago

Keycloak: log injection during webauthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

Affected products

keycloak

<23.0.5
<22.0.9

rh-sso7-keycloak

rhbk/keycloak-rhel9

keycloak-rhel9-container

rh-sso-7/sso7-rhel8-operator

rhbk/keycloak-rhel9-operator

rhbk/keycloak-operator-bundle

rh-sso-7/sso76-openshift-rhel8

Red Hat build of Keycloak 22.0.10

keycloak-rhel9-operator-container

rh-sso-7/sso7-rhel8-init-container

rh-sso-7/sso7-rhel8-operator-bundle

keycloak-rhel9-operator-bundle-container

Matching in nixpkgs

pkgs.keycloak

Identity and access management for modern applications and services

nixos-unstable -
- nixpkgs-unstable 26.3.4

pkgs.terraform-providers.keycloak

None

nixos-unstable -
- nixpkgs-unstable 5.4.0

pkgs.python312Packages.python-keycloak

Provides access to the Keycloak API

nixos-unstable -
- nixpkgs-unstable 4.0.0

pkgs.python313Packages.python-keycloak