CVE-2019-3875: red hat keycloak Improper Certificate Validation

Vulnerability summary

CVE-2019-3875 is a medium (CVSS 6.5) Improper Certificate Validation vulnerability in red hat keycloak. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.

Timeline

1. 12-06-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.

• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.