Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients

高 7.1CVE-2023-2422 · GHSA-3qh5-qqj2-c78f · 04/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-2422 は org.keycloak:keycloak-services, openshift container platform (redhat), single sign-on (redhat) に影響する深刻度「高」 (CVSS 7.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.52%（全脆弱性の 44.3% より高い）。
対処：21.1.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.keycloak:keycloak-services Maven	`< 21.1.2`	`21.1.2`
openshift container platform redhat	`= 4.10= 4.11= 4.12= 4.9`	修正版なし
single sign-on redhat	`= 7.6`	修正版なし

概要

When a Keycloak server is configured to support mTLS authentication for OAuth/OpenID clients, it does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client and therefore access data that belongs to other clients.

NVD の説明

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.