PT-2023-5098 · Red Hat · Keycloak

Chess Hazlett · Publicado 2023-06-26 · Atualizado 2023-10-10 · CVE-2023-2422

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak where a server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. This allows a client with a proper certificate to authorize itself as any other client, accessing data belonging to other clients. The issue is related to errors in the certificate verification procedure, which can be exploited by a remote attacker to impact the confidentiality and integrity of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

BDU:2023-05658

CVE-2023-2422

GHSA-3QH5-QQJ2-C78F

RHSA-2023:3883

RHSA-2023:3884

RHSA-2023:3885

Produtos afetados

Keycloak

Referências · 21

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/commit/5c6c55945a384bfd82e51283096204dcb6f63d91 · Nota
• https://github.com/keycloak/keycloak/security/advisories/GHSA-3qh5-qqj2-c78f · Nota
• https://t.me/cibsecurity/71559 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2023:3883 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2422 · Nota
• https://access.redhat.com/errata/RHSA-2023:3888 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:3892 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:3885 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2191668 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05658 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-2422 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-3qh5-qqj2-c78f · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:3884 · Aviso do Fabricante
• https://t.me/k8security/968 · Publicação no Telegram