CVE-2020-14359

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published: Feb 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-14368.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except CVE-2020-143607.8A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escal CVE-2020-143617.8A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege CVE-2020-143627.8A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege CVE-2020-143637.8An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an app CVE-2020-143645.0An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processi CVE-2020-143657.1A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packag CVE-2020-143667.5A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources CVE-2020-143676.0A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chr CVE-2020-143687.1A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, CVE-2020-143696.3This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted act CVE-2020-14377.8An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka