CVE-2020-35509: Input Validation
A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
A flaw was found in keycloak. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
Depending on the webserver configuration, a malicious user can supply an expired certificate and it would be accepted by Keycloak direct-grant authenticator. This is because Keycloak does not trigger the appropriate timestamp validation.
X509 Direct Grant: https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76
It would seem like PR https://github.com/keycloak/keycloak/pull/6330 missed a spot in adding the validateTimestamps call.
https://issues.redhat.com/browse/KEYCLOAK-16450
— Red Hat
keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.
— GitHub
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw in Keycloak?
The vulnerability ID for this flaw in Keycloak is CVE-2020-35509.
What is the severity of CVE-2020-35509?
The severity of CVE-2020-35509 is medium.
Which versions of Keycloak are affected by CVE-2020-35509?
Versions 11.0.3 and 12.0.0 of Keycloak are affected by CVE-2020-35509.
What is the highest threat from CVE-2020-35509?
The highest threat from CVE-2020-35509 is to data confidentiality and integrity.
How can I fix the vulnerability CVE-2020-35509 in Keycloak?
To fix the vulnerability CVE-2020-35509 in Keycloak, update to version 9.0.15-1.redhat_00002.1.el6, 9.0.15-1.redhat_00002.1.el7, or 9.0.15-1.redhat_00002.1.el8.