PT-2025-18207 · Red Hat+1 · Keycloak+1

Stianst · Publicado 2025-04-29 · Atualizado 2025-11-01 · CVE-2025-3501

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak where setting a verification policy to 'ALL' skips the trust store certificate verification, which is unintended.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-297

Identificadores relacionados

ALT-PU-2025-13422

ALT-PU-2025-6486

CVE-2025-3501

ECHO-32D8-B09C-5C73

GHSA-HW58-3793-42GG

GHSA-R934-W73G-V4P8

Produtos afetados

Alt Linux

Keycloak

Referências · 24

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/pull/39366 · Nota
• https://github.com/keycloak/keycloak/issues/39350 · Nota
• https://github.com/keycloak/keycloak/commit/99ca24c832729075e04d8bc58666089268314272 · Nota
• https://github.com/keycloak/keycloak/security/advisories/GHSA-hw58-3793-42gg · Nota
• https://access.redhat.com/errata/RHSA-2025:8672 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hw58-3793-42gg · Aviso do Fabricante
• https://twitter.com/CVETracker/status/1917670479189479855 · Publicação no Twitter
• https://access.redhat.com/errata/RHSA-2025:8690 · Aviso do Fabricante
• https://t.me/cvenotify/125092 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2025:4336 · Aviso do Fabricante
• https://t.me/cvetracker/22656 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2025:4335 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-3501 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-3501 · Aviso do Fabricante