Repository navigation
Expand file tree
/
Copy path.snyk
More file actions
116 lines (114 loc) · 5.42 KB
/
Copy path.snyk
File metadata and controls
116 lines (114 loc) · 5.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
version: v1.22.2
ignore:
SNYK-JAVA-ORGKEYCLOAK-1062507:
- "*":
reason: >
The Keycloak core module is not affected by Open Redirect
Vulnerability (CVE-2020-1723), that relates to Gatekeeper, an old
project already decommissioned from our org. More details:
- https://issues.redhat.com/browse/KEYCLOAK-11318
- https://www.keycloak.org/2020/08/sunsetting-louketo-project.adoc
- https://hub.docker.com/r/keycloak/keycloak-gatekeeper
SNYK-JAVA-ORGKEYCLOAK-1088339:
- "*":
reason: >
The Keycloak services module is not affected by CVE-2021-3461 anymore,
the issue was fixed on Keycloak 14.0.0 last year. More details:
- https://issues.redhat.com/browse/KEYCLOAK-17495
SNYK-JAVA-IONETTY-1042268:
- "*":
reason: >
There is no fixed version for io.netty:netty-handler. More details:
- https://github.com/netty/netty/issues/10806
- https://github.com/netty/netty/issues/8537
- https://github.com/netty/netty/issues/9930
- https://github.com/netty/netty/issues/10362
Netty Handler is a transitive dependency coming from Quarkus,
according to the Netty team, the fix should be available on Netty 5.
The expiry date was set as a reminder for us to upgrade, once they
provide the fix.
expires: 2023-12-31T00:00:00.000Z
SNYK-JAVA-ORGWILDFLYSECURITY-1316682:
- "*":
reason: >
WildFly Elytron was upgraded and Keycloak is no longer affected
by CVE-2021-3642. The issue was fixed on Elytron 1.10.14.Final,
1.15.5.Final and 1.16.1.Final last year. More details:
- https://issues.redhat.com/browse/ELY-2147
- https://nvd.nist.gov/vuln/detail/CVE-2021-3642
- https://github.com/keycloak/keycloak/pull/11250
- https://github.com/keycloak/keycloak/pull/11197
SNYK-JAVA-ORGKEYCLOAK-1658295:
- "*":
reason: >
Keycloak is no longer vulnerable. The issue was fixed on Keycloak 18.0.0
More details:
- https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v
- https://access.redhat.com/security/cve/cve-2021-3827
SNYK-JAVA-ORGKEYCLOAK-1083276:
- "*":
reason: >
Keycloak is no longer vulnerable. The issue was fixed on Keycloak 18.0.0
More details:
- https://github.com/keycloak/keycloak/security/advisories/GHSA-mwm4-5qwr-g9pf
- https://access.redhat.com/security/cve/cve-2021-3424
SNYK-JAVA-ORGKEYCLOAK-2987457:
- "*":
reason: >
Keycloak is no longer vulnerable. The issue was fixed on Keycloak 19.0.2
More details:
- https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v
- https://access.redhat.com/security/cve/CVE-2022-2668
SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426:
- "*":
reason: >
On latest releases of jackson-databind (2.14.0-rc1 or higher) CVE-2022-42003
is already fixed. Keycloak is not vulnerable to the CVE mentioned. Until 2.14.0
release is out, we should be able to temporarily ignore those alerts from dependency
scanners.
More details:
- https://github.com/keycloak/keycloak/issues/14785
expires: 2022-11-31T00:00:00.000Z
SNYK-JAVA-IOSMALLRYE-2993220:
- "*":
reason: >
Keycloak is not vulnerable. The issue was fixed on Quarkus 2.7.5
More details:
- https://github.com/keycloak/keycloak/issues/14993
# License warnings
snyk:lic:maven:org.eclipse.sisu:org.eclipse.sisu.plexus:EPL-1.0:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Transitive dependency from arquillian-phantom-driver.
snyk:lic:maven:org.eclipse.sisu:org.eclipse.sisu.inject:EPL-1.0:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Transitive dependency from arquillian-phantom-driver.
snyk:lic:maven:com.openshift:openshift-restclient-java:EPL-1.0:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Required by keycloak-services.
snyk:lic:maven:org.mariadb.jdbc:mariadb-java-client:LGPL-2.1:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Transitive dependency from quarkus-jdbc-mariadb.
snyk:lic:maven:org.jboss.narayana.jts:narayana-jts-integration:LGPL-2.1:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Transitive dependency from quarkus-hibernate-orm.
snyk:lic:maven:org.jboss.narayana.jta:narayana-jta:LGPL-2.1:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Transitive dependency from quarkus-hibernate-orm.
snyk:lic:maven:org.hibernate:hibernate-graalvm:LGPL-2.1:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Transitive dependency from quarkus-hibernate-orm.
snyk:lic:maven:org.hibernate:hibernate-core:LGPL-2.1:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Required by keycloak-model-jpa.
snyk:lic:maven:org.hibernate.common:hibernate-commons-annotations:LGPL-2.1:
- "*":
reason: >
Suppress Snyk license compliance warnings for EPL. Required by keycloak-model-jpa.