CVE-2020-35509: Input Validation
First published: Mon Jan 04 2021(Updated: )
A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rh-sso7-keycloak | <0:9.0.15-1.redhat_00002.1.el6 | 0:9.0.15-1.redhat_00002.1.el6 |
| redhat/rh-sso7-keycloak | <0:9.0.15-1.redhat_00002.1.el7 | 0:9.0.15-1.redhat_00002.1.el7 |
| redhat/rh-sso7-keycloak | <0:9.0.15-1.redhat_00002.1.el8 | 0:9.0.15-1.redhat_00002.1.el8 |
| Redhat Keycloak | =11.0.3 | |
| Redhat Keycloak | =12.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/cve-2020-35509
- https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76
- https://github.com/keycloak/keycloak/pull/6330
- https://issues.redhat.com/browse/KEYCLOAK-16450
- https://access.redhat.com/errata/RHSA-2021:3528
- https://access.redhat.com/errata/RHSA-2021:3529
- https://access.redhat.com/errata/RHSA-2021:3527
- https://access.redhat.com/errata/RHSA-2021:3534
- https://bugzilla.redhat.com/show_bug.cgi?id=1912427
- https://www.cve.org/CVERecord?id=CVE-2020-35509 https://nvd.nist.gov/vuln/detail/CVE-2020-35509
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID for this flaw in Keycloak?
The vulnerability ID for this flaw in Keycloak is CVE-2020-35509.
What is the severity of CVE-2020-35509?
The severity of CVE-2020-35509 is medium.
Which versions of Keycloak are affected by CVE-2020-35509?
Versions 11.0.3 and 12.0.0 of Keycloak are affected by CVE-2020-35509.
What is the highest threat from CVE-2020-35509?
The highest threat from CVE-2020-35509 is to data confidentiality and integrity.
How can I fix the vulnerability CVE-2020-35509 in Keycloak?
To fix the vulnerability CVE-2020-35509 in Keycloak, update to version 9.0.15-1.redhat_00002.1.el6, 9.0.15-1.redhat_00002.1.el7, or 9.0.15-1.redhat_00002.1.el8.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-35509
- agent/tags
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- vendor/redhat
- canonical/redhat keycloak
- version/redhat keycloak/11.0.3
- version/redhat keycloak/12.0.0