# CVE-2020-14302 and CVE-2020-10770 before Keycloak 13.0.0

**URL:** <https://forum.keycloak.org/t/cve-2020-14302-and-cve-2020-10770-before-keycloak-13-0-0/7025>\
**Category:** Getting advice\
**Created:** [January 27, 2021, 3:02pm UTC](https://forum.keycloak.org/t/cve-2020-14302-and-cve-2020-10770-before-keycloak-13-0-0/7025 "2021-01-27T15:02:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wh33zy](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/wh33zy/32/1392_2.png) [@wh33zy](https://forum.keycloak.org/u/wh33zy)\
**Post date:** [January 27, 2021, 3:02pm UTC](https://forum.keycloak.org/t/cve-2020-14302-and-cve-2020-10770-before-keycloak-13-0-0/7025/1 "2021-01-27T15:02:04Z")

</div>

Hello everyone,

In both cases “ **A flaw was found in Keycloak before 13.0.0** ”

- CVE-2020-14302
- CVE-2020-10770

On the other hand from here it’s evident, that both CVEs were fixed in version 13.0.0, but from what I understood, this version is unreleased yet.

- [**Bug 1849584**](https://bugzilla.redhat.com/show_bug.cgi?id=1849584)
- [**Bug 1846270**](https://bugzilla.redhat.com/show_bug.cgi?id=1846270)

I decided to use one of the latest version of Keycloak either 12.0.1 or 12.0.2 for my project. How can I figure out that these versions are fixed also and is it even possible?

Thank you.

---

<div class="post-metadata">

**Author:** ![wh33zy](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/wh33zy/32/1392_2.png) [@wh33zy](https://forum.keycloak.org/u/wh33zy)\
**Post date:** [February 1, 2021, 4:38pm UTC](https://forum.keycloak.org/t/cve-2020-14302-and-cve-2020-10770-before-keycloak-13-0-0/7025/2 "2021-02-01T16:38:24Z")

</div>

**[UPDATE]:**  
I found this link: [Update Keycloak to 12.0.0+ · Issue #88 · strimzi/strimzi-kafka-oauth · GitHub](https://github.com/strimzi/strimzi-kafka-oauth/issues/88)

Does it mean that list of all CVEs mentioned in this #88 issue are fixed from version 12.0.1 up to 12.0.2 etc…?

Please, if some responsible person read this post, can you let me know, how I can figure out, if some specific CVE been patched also for specific version of Keycloak?

Because till now, nobody was able to answer me how I can identify if patch for unreleased version 13.0.0 is also backported into latest version 12.0.x.

Thx.

---

<div class="post-metadata">

**Author:** ![borislav.atanasov](https://avatars.discourse-cdn.com/v4/letter/b/4491bb/32.png) [@borislav.atanasov](https://forum.keycloak.org/u/borislav.atanasov)\
**Post date:** [March 12, 2021, 7:23am UTC](https://forum.keycloak.org/t/cve-2020-14302-and-cve-2020-10770-before-keycloak-13-0-0/7025/3 "2021-03-12T07:23:14Z")

</div>

@wh33zy did you get an answer to you questions?

We are in the process of adopting Keycloak 11.0.3, however just recently we paid attention to the vulnerabilities…our scan yields this list:

CVE-2020-10770  
CVE-2020-10776  
CVE-2020-14302  
CVE-2020-14359  
CVE-2020-14366  
CVE-2020-14389  
CVE-2020-1725

Because of this we are thinking of upgrading to version 12.0.4, however even in that version the following are reported:  
CVE-2020-10770  
CVE-2020-14302  
CVE-2020-1725

Does anyone know whether there is a chance these issues to be fixed in versions 11.x or 12.x ?

Thanks

---

<div class="post-metadata">

**Author:** ![jens1](https://avatars.discourse-cdn.com/v4/letter/j/94ad74/32.png) [@jens1](https://forum.keycloak.org/u/jens1)\
**Post date:** [March 17, 2021, 12:39pm UTC](https://forum.keycloak.org/t/cve-2020-14302-and-cve-2020-10770-before-keycloak-13-0-0/7025/4 "2021-03-17T12:39:31Z")

</div>

If they don’t get fixed in 12.x, do we have at least a planned release date for 13.0.0?