CVE-2020-1758

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

Score

CVSS 3.1 5.9 Medium

Status

Modified - secalert@redhat.com

Published

2020-05-15

Last modified

2024-08-04

Weaknesses

CWE-295, CWE-297

Affected products

• Keycloak (Red Hat)
• Keycloak (Redhat)
• Openstack (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1758
• https://issues.redhat.com/browse/KEYCLOAK-13285