En resumen
- CVE-2019-3875 es una vulnerabilidad MEDIO (CVSS 4.8) que afecta a org.keycloak:keycloak-core, keycloak (redhat), single sign-on (redhat).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.29%, mayor que el 21.6% de las vulnerabilidades.
- Solución: actualizar a 6.0.2 o posterior.
Description
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
NVD description
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
Más vulnerabilidades de org.keycloak:keycloak-core
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free