REDHAT-BUG-1912427: Low severity keycloak vulnerability

Published Jan 4, 2021

Updated

Depending on the webserver configuration, a malicious user can supply an expired certificate and it would be accepted by Keycloak direct-grant authenticator. This is because Keycloak does not trigger the appropriate timestamp validation.

X509 Direct Grant: https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76

It would seem like PR https://github.com/keycloak/keycloak/pull/6330 missed a spot in adding the validateTimestamps call.

https://issues.redhat.com/browse/KEYCLOAK-16450

Affected Software

1 affected component

Red Hat Keycloak

Event History

Jan 4, 2021

Data Sourced

via Red Hat·12:40 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1912427?

The severity of REDHAT-BUG-1912427 is high, as it allows the acceptance of expired certificates in Keycloak.

How do I fix REDHAT-BUG-1912427?

To fix REDHAT-BUG-1912427, ensure that you update to the latest version of Keycloak where timestamp validation is correctly implemented.

What impact does REDHAT-BUG-1912427 have on system security?

The impact of REDHAT-BUG-1912427 on system security is significant, as it can enable unauthorized access using expired certificates.

Which versions of Keycloak are affected by REDHAT-BUG-1912427?

All versions of Red Hat Build of Keycloak prior to the fix for REDHAT-BUG-1912427 are affected.

How can I report an exploitation of REDHAT-BUG-1912427?

To report an exploitation of REDHAT-BUG-1912427, contact your organization's security response team or report it through Red Hat's official channels.