CVE-2020-1714

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-1714
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1714.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-1714
Aliases
Downstream
Published
2020-05-13T19:15:11.987Z
Modified
2026-07-08T05:55:47.009708088Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "cpes": [
                "cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:keycloak",
            "extracted_events": [
                {
                    "fixed": "11.0.0"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:decision_manager",
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:jboss_fuse",
            "extracted_events": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.0"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:process_automation",
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                }
            ]
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "redhat:single_sign-on",
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/quarkusio/quarkus

Affected ranges

Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4b5438d1f3e119732d3ffa14f9c2bb6da4a810b3
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.4.2"
        }
    ],
    "cpe": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*"
}

Affected versions

1.*
1.4.2.Final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1714.json"