keycloak CVE-2019-3875 Man in the Middle Security Bypass Vulnerability
BID:108748
CVE-2019-3875 |Info
keycloak CVE-2019-3875 Man in the Middle Security Bypass Vulnerability
| Bugtraq ID: | 108748 |
| Class: | Design Error |
| CVE: |
CVE-2019-3875 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 11 2019 12:00AM |
| Updated: | Jun 11 2019 12:00AM |
| Credit: | Marek Posolda (Red Hat). |
| Vulnerable: |
Redhat Single Sign-On 7.0 Redhat keycloak 6.0.1 Redhat keycloak 6.0 Redhat keycloak 5.0 Redhat keycloak 4.8.3 Redhat keycloak 4.8 Redhat keycloak 3.1 Redhat keycloak 1.0.3 Redhat keycloak 2.5.5 Redhat keycloak 2.5 Redhat keycloak 2.3 Redhat keycloak 2.2.0 Redhat keycloak 2.1 Redhat keycloak 2.0 |
| Not Vulnerable: |
Redhat keycloak 6.0.2 |
References
keycloak CVE-2019-3875 Man in the Middle Security Bypass Vulnerability
References:
References:
- KEYCLOAK-9512 Run x509 tests by default (Github)
- CVE-2019-3875 (Redhat)
- CVE-2019-3875 keycloak: missing signatures validation on CRL (Redhat)
- KEYCLOAK-6056 Map user by Subject Alternative Name (otherName) (Github)
- KEYCLOAK-9572 Support for multiple CRLs with X509 authentication (Github)
- RHSA-2019:1456 - Security Advisory (Redhat)