漏洞关键信息 CVE标识: CVE-2020-1714 漏洞类型: Lack of checks in ObjectInputStream leading to Remote Code Execution 上报时间: 2019-05-03 10:27 UTC 状态: CLOSED ERRATA 严重程度: high 受影响的Product: Security Response 修复版本: keycloak 11.0.0 相关链接: - https://github.com/keycloak/keycloak/pull/7053 - https://issues.jboss.org/browse/KEYCLOAK-10162 漏洞描述 Keycloak代码库中包含在无类型检查的情况下使用ObjectInputStream的情况。攻击者可能利用此漏洞注入任意序列化的Java对象，这些对象将在权限提升的环境中反序列化，导致远程代码执行。 修复信息 修复编号: - RHSA-2020:2813 - RHSA-2020:2814 - RHSA-2020:2816 - RHSA-2020:2905 - RHSA-2020:3017 - RHSA-2020:3675 - RHSA-2020:3678 - RHSA-2020:4252 - RHSA-2020:5568 影响的产品 Red Hat Single Sign-On 7.4.1 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6, 7, 8 Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6, 7 Red Hat Openshift Application Runtimes Red Hat Runtimes Spring Boot 2.1.15 Red Hat Decision Manager Red Hat Process Automation Red Hat build of Quarkus 1.7.5 Red Hat Fuse 7.8.0