CVE-2020-1758: Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak
Summary
CVE-2020-1758: Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak. Affects org.keycloak:keycloak-parent versions < 10.0.0. Fixed in 10.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows users to authenticate and authorize applications. It provides features such as single sign-on, social login, and user federation. Keycloak is widely used in enterprise environments to secure applications and APIs.
Vulnerability Detail
A flaw was found in Keycloak versions before 10.0.0, where it does not perform TLS hostname verification while sending emails using the SMTP server. This vulnerability allows an attacker to perform a man-in-the-middle (MITM) attack. By intercepting the communication between Keycloak and the SMTP server, an attacker can read or modify the content of the emails being sent, potentially leading to unauthorized access or information disclosure.
How To Fix
Minimum fixed version
10.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Keycloak is not immediately feasible, a temporary workaround is to disable email notifications or use a secure SMTP server that performs proper TLS hostname verification. However, it is strongly advised to upgrade to the latest version as soon as possible to fully mitigate the vulnerability.
Conclusion
In conclusion, the vulnerability in Keycloak versions before 10.0.0 allows for a man-in-the-middle attack during email communication with the SMTP server. To mitigate this vulnerability, it is crucial to upgrade Keycloak to version 10.0.0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-parent →
FAQ
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications and APIs.
This vulnerability allows an attacker to perform a man-in-the-middle attack and potentially read or modify the content of emails sent by Keycloak.
To fix this vulnerability, you should upgrade Keycloak to version 10.0.0 or later. Follow the upgrade instructions provided by the Keycloak documentation.
A temporary workaround is to disable email notifications or use a secure SMTP server that performs proper TLS hostname verification. However, upgrading to the latest version is strongly recommended.
You can find more information about Keycloak on the official Keycloak website and documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-parent.
