CVE-2020-1758

Root

Cause

CVE-2020-1758 affects Keycloak versions prior to 10.0.0. The flaw exists because the application does not perform TLS hostname verification when establishing an SMTP connection to send emails. Without verifying that the SMTP server's certificate matches the expected hostname, the connection is vulnerable to interception [1][2].

Exploitation

An attacker in a position to intercept network traffic between the Keycloak server and the SMTP server can perform a man-in-the-middle (MITM) attack. The attack requires the ability to spoof or substitute the SMTP server certificate. No authentication is needed beyond network access to the communication path [1].

Impact

If successfully exploited, an attacker can read, modify, or intercept email content sent by Keycloak, such as password reset emails or other notifications. This could lead to information disclosure or account compromise [1][2].

Mitigation

The issue is fixed in Keycloak version 10.0.0. Red Hat has also shipped fixes in Red Hat Single Sign-On 7.3 for RHEL 6, 7, and 8 (RHSA-2020:2106, RHSA-2020:2107, RHSA-2020:2108). Administrators unable to upgrade can mitigate by disabling all email notifications, including password reset emails [2].