{
  "threat_severity" : "Important",
  "public_date" : "2019-08-13T00:00:00Z",
  "bugzilla" : {
    "description" : "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation",
    "id" : "1728609",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1728609"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-287",
  "details" : [ "It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.", "It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Runtimes Spring Boot 2.1.12",
    "release_date" : "2020-06-04T00:00:00Z",
    "advisory" : "RHSA-2020:2366",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0",
    "package" : "keycloak"
  }, {
    "product_name" : "Red Hat Single Sign-On 7.3.3 zip",
    "release_date" : "2019-08-13T00:00:00Z",
    "advisory" : "RHSA-2019:2483",
    "cpe" : "cpe:/a:redhat:jboss_single_sign_on:7.3"
  }, {
    "product_name" : "Text-Only RHOAR",
    "release_date" : "2020-05-18T00:00:00Z",
    "advisory" : "RHSA-2020:2067",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Will not fix",
    "package_name" : "keycloak",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Mobile Application Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "keycloak",
    "cpe" : "cpe:/a:redhat:mobile_application_platform:4"
  }, {
    "product_name" : "Red Hat OpenShift Application Runtimes",
    "fix_state" : "Affected",
    "package_name" : "keycloak",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  }, {
    "product_name" : "Red Hat Single Sign-On 7",
    "fix_state" : "Affected",
    "package_name" : "rh-sso7-keycloak",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-10201\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-10201" ],
  "name" : "CVE-2019-10201",
  "mitigation" : {
    "value" : "Administrator can prevent this issue for POST binding by requiring signed assertions.",
    "lang" : "en:us"
  },
  "csaw" : false
}