REDHAT-BUG-1912427
First published: Mon Jan 04 2021(Updated: )
Depending on the webserver configuration, a malicious user can supply an expired certificate and it would be accepted by Keycloak direct-grant authenticator. This is because Keycloak does not trigger the appropriate timestamp validation. X509 Direct Grant: <a href="https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76">https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76</a> It would seem like PR <a href="https://github.com/keycloak/keycloak/pull/6330">https://github.com/keycloak/keycloak/pull/6330</a> missed a spot in adding the validateTimestamps call. <a href="https://issues.redhat.com/browse/KEYCLOAK-16450">https://issues.redhat.com/browse/KEYCLOAK-16450</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Keycloak |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76
- https://github.com/keycloak/keycloak/pull/6330
- https://issues.redhat.com/browse/KEYCLOAK-16450
- https://access.redhat.com/errata/RHSA-2021:3528
- https://access.redhat.com/errata/RHSA-2021:3529
- https://access.redhat.com/errata/RHSA-2021:3527
- https://access.redhat.com/errata/RHSA-2021:3534
- https://access.redhat.com/security/cve/cve-2020-35509
- https://bugzilla.redhat.com/show_bug.cgi?id=1912427
Frequently Asked Questions
What is the severity of REDHAT-BUG-1912427?
The severity of REDHAT-BUG-1912427 is high, as it allows the acceptance of expired certificates in Keycloak.
How do I fix REDHAT-BUG-1912427?
To fix REDHAT-BUG-1912427, ensure that you update to the latest version of Keycloak where timestamp validation is correctly implemented.
What impact does REDHAT-BUG-1912427 have on system security?
The impact of REDHAT-BUG-1912427 on system security is significant, as it can enable unauthorized access using expired certificates.
Which versions of Keycloak are affected by REDHAT-BUG-1912427?
All versions of Red Hat Build of Keycloak prior to the fix for REDHAT-BUG-1912427 are affected.
How can I report an exploitation of REDHAT-BUG-1912427?
To report an exploitation of REDHAT-BUG-1912427, contact your organization's security response team or report it through Red Hat's official channels.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-35509
- agent/source
- agent/severity
- agent/description
- agent/references
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/keycloak