Keycloak 9.1 CVE: Unauthenticated account takeover

Projekte und Software openDesk (Projekt 351)
1

Dear friends,

Note that there’s a 9.1 CVE in Keycloak:

It is fixed in the freshly released 26.7.2.

I have deployed OpenDesk on-prem last month (*) via the helmfile repo, and thus I hope to see an update there soon so we can upgrade Keycloak.

I trust you will have noticed this CVE, but given that scope of the project is rather vast, I felt that it wouldn’t hurt to bring it to your attention.

Thank you for everything you do.
joost

(*) I hit a bunch of sharp edges, and have taken notes for feedback, but I’m not entire sure where to turn to, or who would be interested. If you are, please let me know.

2

Dear Joost,

thank you for the notification, but openDesk isn’t using the affected password reset flow, as the password reset is done through the Nubus self-service.

Cheers, Thorsten

3

Thank you Thorsten for that valuable bit of info, much appreciated :pray: