diff --git a/advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json b/advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json index b920f945cb4..295b0aed6cc 100644 --- a/advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json +++ b/advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-69fp-7c8p-crjr", - "modified": "2024-06-10T18:36:56Z", + "modified": "2024-07-31T14:51:21Z", "published": "2024-06-10T18:36:56Z", "aliases": [ - + "CVE-2024-4540" ], "summary": "Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)", "details": "A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.", @@ -40,10 +40,58 @@ "type": "WEB", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-69fp-7c8p-crjr" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4540" + }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/2191cc26ae6deb52eeaf74046027b65804d16fd0" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3566" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3567" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3568" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3570" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3572" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3573" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3574" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3575" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3576" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-4540" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279303" + }, { "type": "PACKAGE", "url": "https://github.com/keycloak/keycloak" @@ -51,6 +99,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-200", "CWE-922" ], "severity": "HIGH",