CVE-2023-2422
5.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Summary
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | 0:18.0.8-1.redhat_00001.1.el7sso < * | unaffected |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | 0:18.0.8-1.redhat_00001.1.el8sso < * | unaffected |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | 0:18.0.8-1.redhat_00001.1.el9sso < * | unaffected |
| Red Hat | RHEL-8 based Middleware Containers | 7.6-24 < * | unaffected |
Weaknesses
- CWE-295: Improper Certificate Validation
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
- https://access.redhat.com/errata/RHSA-2023:3883
- https://access.redhat.com/errata/RHSA-2023:3884
- https://access.redhat.com/errata/RHSA-2023:3885
- https://access.redhat.com/errata/RHSA-2023:3888
- https://access.redhat.com/errata/RHSA-2023:3892
- https://access.redhat.com/security/cve/CVE-2023-2422
- https://bugzilla.redhat.com/show_bug.cgi?id=2191668
References
- https://access.redhat.com/errata/RHSA-2023:3883
- https://access.redhat.com/errata/RHSA-2023:3884
- https://access.redhat.com/errata/RHSA-2023:3885
- https://access.redhat.com/errata/RHSA-2023:3888
- https://access.redhat.com/errata/RHSA-2023:3892
- https://access.redhat.com/security/cve/CVE-2023-2422
- https://bugzilla.redhat.com/show_bug.cgi?id=2191668
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.