Bug 1211784 (CVE-2023-1664) - VUL-0: CVE-2023-1664: keycloak: Untrusted Certificate Validation
Summary: VUL-0: CVE-2023-1664: keycloak: Untrusted Certificate Validation
Status: RESOLVED INVALID
Alias: CVE-2023-1664
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.4
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: Leap 15.4
Assignee: Security Team bot
QA Contact: E-mail List
URL: https://smash.suse.de/issue/361499/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-05-29 03:04 UTC by Stoyan Manolov
Modified: 2024-04-23 11:11 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stoyan Manolov 2023-05-29 03:04:27 UTC
CVE-2023-1664

A flaw was found in Keycloak. This flaw depends on a non-default configuration
"Revalidate Client Certificate" to be enabled and the reverse proxy is not
validating the certificate before Keycloak. Using this method an attacker may
choose the certificate which will be validated by the server. If this happens
and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any
trustfile may be accepted with the logging information of "Cannot validate
client certificate trust: Truststore not available". This may not impact
availability as the attacker would have no access to the server, but consumer
applications Integrity or Confidentiality may be impacted considering a possible
access to them. Considering the environment is correctly set to use "Revalidate
Client Certificate" this flaw is avoidable.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1664
https://bugzilla.redhat.com/show_bug.cgi?id=2182196&comment#0
https://bugzilla.redhat.com/show_bug.cgi?id=2182196
https://www.cve.org/CVERecord?id=CVE-2023-1664
Comment 1 Fridrich Strba 2024-04-02 15:30:43 UTC
The package lives here https://build.opensuse.org/package/show/Java:binaries/keycloak and the version there is the repackaged 24.0.2 which is having this one fixed. I don't see it anywhere in backports, so most likely it is not there.
Reassigning to security to know what to do: close or not to close.