PT-2022-8928 · Red Hat · Keycloak

Luca Leonardo Scorcia · Published 2022-08-23 · Updated 2025-06-30 · CVE-2020-35509

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions keycloak versions 11.0.3 through 13.0.0

Description A flaw was found in the direct-grant authenticator of keycloak, where an expired certificate would be accepted due to missing time stamp validations. The highest threat from this issue is to data confidentiality and integrity.

Recommendations For keycloak versions 11.0.3 through 12.0.0, update to version 14.0.0 to fully resolve the issue. For keycloak versions 13.0.0, update to version 14.0.0 for a more complete fix, as version 13.0.1 only partially addresses the issue. As a temporary workaround, consider restricting the use of the direct-grant authenticator until a patch is applied.

Fix

Improper Certificate Validation

RCE

Weakness Enumeration

CWE-295

CWE-20

Related Identifiers

CVE-2020-35509

GHSA-RPJ2-W6FR-79HC

RHSA-2021:3527

RHSA-2021:3528

RHSA-2021:3529

Affected Products

Keycloak

References · 11

• https://osv.dev/vulnerability/CVE-2020-35509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35509 · Security Note
• https://access.redhat.com/security/cve/cve-2020-35509 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpj2-w6fr-79hc · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/pull/6330 · Note
• https://github.com/keycloak/keycloak/pull/8067 · Note
• https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76 · Note
• https://github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2af79f679bb · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1912427 · Note
• https://t.me/cvenotify/127164 · Telegram Post