GHSA-5cc8-pgp5-7mpm

    Dashboard / Vulnerabilities / GHSA-5cc8-pgp5-7mpm

    GHSA-5cc8-pgp5-7mpm

    Published: 30 Jun 2023Last Modified: 16 Feb 2024
    Aliases:
    CVE-2023-1664

    Summary: Keycloak Untrusted Certificate Validation vulnerability

    Details: A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client Certificate Authenticatior with the option "Revalidate Client Certificate". A user may be able to choose, if directly connect to keycloak (not passing via reverse proxy) a specific certificate. If there's a configuration error in KC_SPI_TRUSTSTORE_FILE_FILE the authenticator allows even with the "Cannot validate client certificate trust: Truststore not available" message as there's no certificate to trust against.

    References: https://github.com/keycloak/keycloak/security/advisories/GHSA-5cc8-pgp5-7mpm, https://nvd.nist.gov/vuln/detail/CVE-2023-1664, https://access.redhat.com/security/cve/CVE-2023-1664, https://bugzilla.redhat.com/show_bug.cgi?id=2182196&comment#0, https://github.com/keycloak/keycloak

    Affected packages

    Package

    Name: org.keycloak:keycloak-core

    Purl: pkg:maven/org.keycloak/keycloak-core

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -21.1.2

    Affected versions

    1.0-alpha-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-5cc8-pgp5-7mpm | CVE-DB