BSD Portskeycloak -- Multiple security fixes
· CVE-2024-11734, CVE-2024-11736 · VuXML entry
Keycloak reports: This update includes 2 security fixes: CVE-2024-11734: Unrestricted admin use of system and environment variables CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers
Affected versions
- keycloak < 26.0.8
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/keycloak | 26.2.3 | fixed | |
| OpenBSD | security/keycloak | 26.7.3 | out of range, by version | |
| NetBSD | wip/py-keycloak | 3.0.0 | not listed | |
| FreeBSD | net/keycloak | 26.8.1 | fixed | (544 days after) |