Описание
A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.
Отчет
Red Hat Enterprise Application Platform does not ship the Keycloak server code and thus is not affected by this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8 | keycloak-core | Not affected | ||
| Red Hat Single Sign-On 7 | org.keycloak/keycloak-core | Affected | ||
| Red Hat build of Keycloak 24 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2024:10175 | 21.11.2024 |
| Red Hat build of Keycloak 24 | rhbk/keycloak-rhel9 | Fixed | RHSA-2024:10175 | 21.11.2024 |
| Red Hat build of Keycloak 24 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2024:10175 | 21.11.2024 |
| Red Hat build of Keycloak 24.0.9 | org.keycloak/keycloak-core | Fixed | RHSA-2024:10176 | 21.11.2024 |
| Red Hat build of Keycloak 26.0 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2024:10177 | 21.11.2024 |
| Red Hat build of Keycloak 26.0 | rhbk/keycloak-rhel9 | Fixed | RHSA-2024:10177 | 21.11.2024 |
| Red Hat build of Keycloak 26.0 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2024:10177 | 21.11.2024 |
| Red Hat build of Keycloak 26.0.6 | org.keycloak/keycloak-core | Fixed | RHSA-2024:10178 | 21.11.2024 |
Показывать по
Дополнительная информация
Статус:
7.1 High
CVSS3
Связанные уязвимости
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
Уязвимость реализации протокола mTLS (mutual TLS) программного средства для управления идентификацией и доступом Keycloak, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации
7.1 High
CVSS3