A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Redhat
  • Build Keycloak

No data.

Package CPE Advisory Released Date
Red Hat build of Keycloak 24
rhbk/keycloak-operator-bundle:24.0.9-1 cpe:/a:redhat:build_keycloak:24::el9 RHSA-2024:10175 2024-11-21T00:00:00Z
rhbk/keycloak-rhel9:24-18 cpe:/a:redhat:build_keycloak:24::el9 RHSA-2024:10175 2024-11-21T00:00:00Z
rhbk/keycloak-rhel9-operator:24-18 cpe:/a:redhat:build_keycloak:24::el9 RHSA-2024:10175 2024-11-21T00:00:00Z
Red Hat build of Keycloak 24.0.9
org.keycloak/keycloak-core cpe:/a:redhat:build_keycloak:24 RHSA-2024:10176 2024-11-21T00:00:00Z
Red Hat build of Keycloak 26.0
rhbk/keycloak-operator-bundle:26.0.6-2 cpe:/a:redhat:build_keycloak:26.0::el9 RHSA-2024:10177 2024-11-21T00:00:00Z
rhbk/keycloak-rhel9:26.0-5 cpe:/a:redhat:build_keycloak:26.0::el9 RHSA-2024:10177 2024-11-21T00:00:00Z
rhbk/keycloak-rhel9-operator:26.0-6 cpe:/a:redhat:build_keycloak:26.0::el9 RHSA-2024:10177 2024-11-21T00:00:00Z
Red Hat build of Keycloak 26.0.6
org.keycloak/keycloak-core cpe:/a:redhat:build_keycloak:26 RHSA-2024:10178 2024-11-21T00:00:00Z
References
Link Providers
https://nvd.nist.gov/vuln/detail/CVE-2024-10039 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-10039 cve-icon
History

Fri, 22 Nov 2024 14:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.
Title keycloak-core: mTLS passthrough
First Time appeared Redhat
Redhat build Keycloak
Weaknesses CWE-295
CPEs cpe:/a:redhat:build_keycloak:24
cpe:/a:redhat:build_keycloak:24::el9
cpe:/a:redhat:build_keycloak:26
cpe:/a:redhat:build_keycloak:26.0::el9
Vendors & Products Redhat
Redhat build Keycloak
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Important
cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2024-11-21T16:45:00Z

Links: CVE-2024-10039 - Bugzilla