CVE-2019-3875
mediumpriority · track · 19OT risk · elevatedEPSS 0.003 · 20 %ileDEEUUSEPSS · scored 2026-10-22
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-1947Red Hat Single Sign On: Mehrere SchwachstellenDeutsch2019-06-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service Zustand hervorzurufen, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.
- GHSA-38cg-gg9j-q9j9Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak2019-06-27ghsa · osvUS
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (19)
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2019:1456cnnvd
- https://access.redhat.com/security/cve/cve-2019-3875cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1690628Bug1690628cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3875cnnvd
- https://github.com/keycloak/keycloak/commit/996389d61b1996ac6fe2ce2264fba0616f006055cnnvd
- https://github.com/keycloak/keycloak/commit/a48698caa32933458916980ab05256f56099a337cnnvd
- https://github.com/keycloak/keycloak/commit/db271f7150aae914a8f256ccb48e9d1dac9d7126cnnvd
- https://packetstormsecurity.com/files/157741/Red-Hat-Security-Advisory-2020-2067-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan