VYPR
← All advisories
High severityNVD Advisory· Published Oct 4, 2023· Updated Aug 2, 2024

Keycloak: oauth client impersonation

CVE-2023-2422

Description

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-servicesMaven
< 21.1.221.1.2

Affected products

6
  • Red Hat/Single Sign Oncpe-rescue4 versions
    cpe:/a:redhat:red_hat_single_sign_on:7.6.4+ 3 more
    • cpe:/a:redhat:red_hat_single_sign_on:7.6.4
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el7range: 0:18.0.8-1.redhat_00001.1.el7sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el8range: 0:18.0.8-1.redhat_00001.1.el8sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el9range: 0:18.0.8-1.redhat_00001.1.el9sso
  • Red Hat/RHEL-8 based Middleware Containersv5
    cpe:/a:redhat:rhosemc:1.0::el8
    Range: 7.6-24
  • ghsa-coords
    pkg:maven/org.keycloak/keycloak-services
    Range: < 21.1.2

Patches

Vulnerability mechanics

References

11

News mentions

0

No linked articles in our index yet.