CVE-2020-1714

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-1714
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1714.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-1714
Aliases
Downstream
Published
2020-05-13T19:15:11.987Z
Modified
2026-04-10T04:23:46.981764Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type
GIT
Repo
https://github.com/keycloak/keycloak
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
798f1cb2514789d24676b118feafab872d27d838
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e6a274ea0e31c6572e795f3372f006c88122539b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e6a274ea0e31c6572e795f3372f006c88122539b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e6a274ea0e31c6572e795f3372f006c88122539b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e6a274ea0e31c6572e795f3372f006c88122539b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/quarkusio/quarkus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4b5438d1f3e119732d3ffa14f9c2bb6da4a810b3
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.4.2"
        }
    ]
}

Affected versions

1.*
1.0-alpha-1
1.0-alpha-1-12062013
1.0-alpha-2
1.0-alpha-3
1.0-beta-1
1.0-beta-2
1.0-beta-4
1.0-final
1.0-rc-1
1.0.0.Final
1.1.0.Beta2
1.3.0.Final
1.4.2.Final
2.*
2.4.0.Test
7.*
7.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1714.json"