GHSA-38cg-gg9j-q9j9 CVE-2019-3875
Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak
- Severity
- 4.8 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- 0.29%
- Chance of exploitation in the next 30 days. Higher than 21.65% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-295 Improper Certificate Validation
- CWE-345 Insufficient Verification of Data Authenticity
- Fix
- None yet
- No fixed version published
Description
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-core | <= 6.0.1 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.0 4.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it
- Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-q4xq-445g-g6ch Keycloak allows cross-site scripting (XSS) | Low | Also affects org.keycloak:keycloak-core |
| GHSA-93ww-43rr-79v3 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination | High | Also affects org.keycloak:keycloak-core |
| GHSA-w97f-w3hq-36g2 Keycloak Denial of Service vulnerability | High | Also affects org.keycloak:keycloak-core |
| GHSA-xmmm-jw76-q7vg Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-g4gc-rh26-m3p5 Keycloak Open Redirect vulnerability | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-9vm7-v8wj-3fqw keycloak-core: open redirect via "form_post.jwt" JARM response mode | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-5q66-v53q-pm35 Keycloak vulnerable to Plaintext Storage of User Password | High | Also affects org.keycloak:keycloak-core |
| GHSA-5cc8-pgp5-7mpm Keycloak Untrusted Certificate Validation vulnerability | Medium | Also affects org.keycloak:keycloak-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor