Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ycGoyLXc2ZnItNzloY84AAuZ2

Keycloak vulnerable to Improper Certificate Validation

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.

Permalink: https://github.com/advisories/GHSA-rpj2-w6fr-79hc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycGoyLXc2ZnItNzloY84AAuZ2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Identifiers: GHSA-rpj2-w6fr-79hc, CVE-2020-35509
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-35509
• https://access.redhat.com/security/cve/cve-2020-35509
• https://github.com/keycloak/keycloak/pull/6330
• https://github.com/keycloak/keycloak/pull/8067
• https://github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2af79f679bb
• https://bugzilla.redhat.com/show_bug.cgi?id=1912427
• https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76
• https://github.com/advisories/GHSA-rpj2-w6fr-79hc

Repository: https://github.com/keycloak/keycloak
Blast Radius: 16.5

Affected Packages