PT-2023-5098 · Red Hat · Keycloak

Chess Hazlett · Published 2023-06-26 · Updated 2023-10-10 · CVE-2023-2422

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak where a server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. This allows a client with a proper certificate to authorize itself as any other client, accessing data belonging to other clients. The issue is related to errors in the certificate verification procedure, which can be exploited by a remote attacker to impact the confidentiality and integrity of protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2023-05658

CVE-2023-2422

GHSA-3QH5-QQJ2-C78F

RHSA-2023:3883

RHSA-2023:3884

RHSA-2023:3885

Affected Products

Keycloak

References · 21

• https://access.redhat.com/errata/RHSA-2023:3883 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:3888 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:3892 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:3885 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2191668 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05658 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2422 · Security Note
• https://osv.dev/vulnerability/GHSA-3qh5-qqj2-c78f · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:3884 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-2422 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2422 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/5c6c55945a384bfd82e51283096204dcb6f63d91 · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-3qh5-qqj2-c78f · Note
• https://t.me/cibsecurity/71559 · Telegram Post