CVE-2017-2582: Information Exposure

July 26, 2018 (updated January 23, 2019)

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the InResponseTo field in the response.

References

www.securityfocus.com/bid/101046
www.securitytracker.com/id/1041707
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2582
nvd.nist.gov/vuln/detail/CVE-2017-2582

Detect and mitigate CVE-2017-2582 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →