Vulnerability Description
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Keycloak | < 10.0.0 |
| Redhat | Openstack | 10 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758Issue TrackingVendor Advisory
- https://issues.redhat.com/browse/KEYCLOAK-13285Permissions RequiredVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758Issue TrackingVendor Advisory
- https://issues.redhat.com/browse/KEYCLOAK-13285Permissions RequiredVendor Advisory
FAQ
What is CVE-2020-1758?
CVE-2020-1758 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a ma...
How severe is CVE-2020-1758?
CVE-2020-1758 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1758?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Keycloak, Redhat Openstack.