Описание
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Отчет
Red Hat has rated this as an Important severity, although this configuration is not recommended, especially in production environments.
Меры по смягчению последствий
Use the correct TLS configuration and avoid using "--tls-hostname-verifier=any".
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Single Sign-On 7 | rh-sso7-keycloak | Not affected | ||
| Red Hat Build of Keycloak | keycloak | Fixed | RHSA-2025:4336 | 29.04.2025 |
| Red Hat build of Keycloak 26 | Fixed | RHSA-2025:8690 | 09.06.2025 | |
| Red Hat build of Keycloak 26.0 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2025:4335 | 29.04.2025 |
| Red Hat build of Keycloak 26.0 | rhbk/keycloak-rhel9 | Fixed | RHSA-2025:4335 | 29.04.2025 |
| Red Hat build of Keycloak 26.0 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2025:4335 | 29.04.2025 |
| Red Hat build of Keycloak 26.2 | rhbk/keycloak-operator-bundle | Fixed | RHSA-2025:8672 | 09.06.2025 |
| Red Hat build of Keycloak 26.2 | rhbk/keycloak-rhel9 | Fixed | RHSA-2025:8672 | 09.06.2025 |
| Red Hat build of Keycloak 26.2 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2025:8672 | 09.06.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.2 High
CVSS3
Связанные уязвимости
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
A flaw was found in Keycloak. By setting a verification policy to 'ALL ...
ALT-PU-2025-6486: package `keycloak` update to version 26.2.4-alt1
ALT-PU-2025-13422: package `keycloak` update to version 26.4.0-alt1
EPSS
8.2 High
CVSS3