Keycloak vulnerable to Improper Certificate Validation

2022-08-2400:00:29

Google

osv.dev

keycloak

vulnerable

certificate validation

expired

data confidentiality

data integrity

security issue

software

version 13.0.1

version 14.0.0

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

22.7%

JSON

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.

References

access.redhat.com/security/cve/cve-2020-35509

bugzilla.redhat.com/show_bug.cgi?id=1912427

github.com/keycloak/keycloak

github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76

github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2af79f679bb

github.com/keycloak/keycloak/pull/6330

github.com/keycloak/keycloak/pull/8067

nvd.nist.gov/vuln/detail/CVE-2020-35509