PT-2019-16749 · Red Hat · Keycloak

Laura Pardo · Published 2019-06-12 · Updated 2019-10-09 · CVE-2019-3875

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 6.0.2

Description A vulnerability was found in the X.509 authenticator, which supports the verification of client certificates through the Certificate Revocation List (CRL). The CRL can be obtained from the URL provided in the certificate itself (CDP) or through a separately configured path. However, the CRL is often available over the network through unsecured protocols, such as 'http' or 'ldap'. As a result, Keycloak's failure to validate signatures on CRL can lead to various attacks, including man-in-the-middle attacks.

Recommendations For versions prior to 6.0.2, update to version 6.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the X.509 authenticator or verifying the signature and certification path of the CRL manually until a patch is applied.

Fix

Insufficient Verification of Data Authenticity

Improper Certificate Validation

Weakness Enumeration

CWE-345

CWE-295

Related Identifiers

CVE-2019-3875

GHSA-38CG-GG9J-Q9J9

Affected Products

Keycloak

References · 5

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3875 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3875 · Security Note
• https://osv.dev/vulnerability/GHSA-38cg-gg9j-q9j9 · Vendor Advisory
• http://securityfocus.com/bid/108748 · Note