[GHSA-93ww-43rr-79v3] Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination

[westonsteimel]

Updates

• Affected products

Comments
just adding 24.0.9 to the patch list, the affected range was already < 24.0.9
keycloak/keycloak@3da16ee

[github]

Hi there @jonkoops! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[jonkoops]

The last release in Keycloak 24.x was 24.0.5, after that there have (and will not) be any further official releases. The fix linked here is in a branch that is used for LTS variants for various downstreams (e.g.Red Hat build of Keycloak).

[darakian]

Thanks for the context @jonkoops and good to know. @westonsteimel, given that the patched version isn't (and won't) be published to maven central I'm not sure we want to add it to our advisory. I think the fix commit would be good to have, but thoughts?

[westonsteimel]

Thanks for the context @jonkoops and good to know. @westonsteimel, given that the patched version isn't (and won't) be published to maven central I'm not sure we want to add it to our advisory. I think the fix commit would be good to have, but thoughts?

Should we add 26.0.6 as the recommended patch for the 24.x range then as well?

[darakian]

Oh that's a thought. I suppose we would be suggesting a potentially breaking change, but it wouldn't be the first time. Any opposition @jonkoops or are you ok with suggesting 24.x users migrate to 26?

[jonkoops]

I am not sure why it ended up in the advisory, but I believe 24.0.9 should not be mentioned at all, as that is meant for downstream versions, the fixed version is 26.0.6 and the recommendation here is to upgrade to that version (or later). @rmartinc @abstractj @sschu WDYT?

[westonsteimel]

So just drop the < 24.0.9 range and make a single range of < 26.0.6? That seems reasonable to me

[rmartinc]

@jonkoops Yes, I think that 24.0.9 can be deleted in that advisory. But just upgrade to 26.0.6 or later.

[jonkoops]

Great, if you would like to make the changes @westonsteimel that would be appreciated.

[github]

Hi there @jonkoops! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[abstractj]

See the changes requested by @jonkoops

[jonkoops]

LGTM

[advisory-database]

Hi @westonsteimel! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[darakian]

Merged in. Thanks all 👍