Keycloak vulnerable to Improper Certificate Validation

2022-08-2400:00:29

CWE-295

GitHub Advisory Database

github.com

keycloak

authentication

vulnerability

certificate validation

data confidentiality

data integrity

software security

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

22.7%

JSON

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.

Affected configurations

Vulners

Node

org.keycloak\keycloakMatchcore

VendorProductVersionCPE
org.keycloak\keycloakcorecpe:2.3:a:org.keycloak\:keycloak:core:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.keycloak\	keycloak	core	cpe:2.3:a:org.keycloak\:keycloak:core::::::::

References

access.redhat.com/security/cve/cve-2020-35509

bugzilla.redhat.com/show_bug.cgi?id=1912427

github.com/advisories/GHSA-rpj2-w6fr-79hc

github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76

github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2af79f679bb

github.com/keycloak/keycloak/pull/6330

github.com/keycloak/keycloak/pull/8067

nvd.nist.gov/vuln/detail/CVE-2020-35509