Read the docs
TI-2019-02885 Aliases CVE-2019-3875GHSA-38cg-gg9j-q9j9

Improper certificate validation in Red Hat keycloak

Priority LOW 29CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing, Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 fixed, 5 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295 and CWE-345.

Summary

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.

Why it matters now

EPSS 0.00291 21st percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatkeycloak6.0.2—No fix listedCNA
—org.keycloak:keycloak-core (Maven)up to 6.0.1—No fix listedGHSA-38cg-gg9j-q9j9
  • keycloak VendorRed Hat Affected 6.0.2 Fixed in — No fix listed CNA
  • org.keycloak:keycloak-core (Maven) Vendor— Affected up to 6.0.1 Fixed in — No fix listed GHSA-38cg-gg9j-q9j9

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*before 6.0.2VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 6.0.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2020:2366 Released 2020-06-04 · Red Hat rating Important
    Red Hat support for Spring Boot 2.1.12 security and bug fix update
    • Red Hat Runtimes Spring Boot 2.1.12
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2019:1456 Released 2019-06-11 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.3.2 security update
    • Red Hat Single Sign-On 7.3.2 zip

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Mobile Application Platform 4AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat support for Spring BootAffectedNo fix yet
Red Hat Runtimes Spring Boot 2.1.12Fixed RHSA-2020:2366
Red Hat Single Sign-On 7.3.2 zipFixed RHSA-2019:1456
Text-Only RHOARFixed RHSA-2020:2067

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3875
  2. 2026-10-03 Alias added: GHSA-38cg-gg9j-q9j9

References

Patch 1

Advisory 1

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences