CVE-2025-3501
Org.keycloak.protocol.services: keycloak hostname verification
HIGH 8.2
En bref
- Source
- NVD
- EPSS
- EPSS 0.46 % · centile 40 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Deferred
Description
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Faiblesses (CWE)
- CWE-297 — Validation incorrecte d'un certificat dont l'hôte ne correspond pas
Références
- https://access.redhat.com/errata/RHSA-2025:4335
- https://access.redhat.com/errata/RHSA-2025:4336
- https://access.redhat.com/errata/RHSA-2025:8672
- https://access.redhat.com/errata/RHSA-2025:8690
- https://access.redhat.com/security/cve/CVE-2025-3501
- https://bugzilla.redhat.com/show_bug.cgi?id=2358834
- https://github.com/keycloak/keycloak/issues/39350
- https://github.com/keycloak/keycloak/pull/39366
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | redhat |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · secalert@redhat.com (Secondary) |
Avis
- GHSA-hw58-3793-42gg — Keycloak hostname verification
Références européennes
- ENISA EUVD · EUVD-2025-12660
- GCVE · GCVE-0-2025-3501
Produits affectés
| Produit | Versions |
|---|---|
| keycloak | affected 25.0.0 < 25.* ; affected 26.0.0 < 26.0.11 ; unknown 26.1.0 < 26.1.* ; affected 26.2.0 < 26.2.2 |
| Red Hat · Red Hat Build of Keycloak | |
| Red Hat · Red Hat build of Keycloak 26 | |
| Red Hat · Red Hat build of Keycloak 26.0 | unaffected 26.0.11-2 < * |
| Red Hat · Red Hat build of Keycloak 26.0 | unaffected 26.0-12 < * |
| Red Hat · Red Hat build of Keycloak 26.0 | unaffected 26.0-13 < * |
| Red Hat · Red Hat build of Keycloak 26.2 | unaffected 26.2.5-1 < * |
| Red Hat · Red Hat build of Keycloak 26.2 | unaffected 26.2-4 < * |
| Red Hat · Red Hat build of Keycloak 26.2 | unaffected 26.2-4 < * |
| Red Hat · Red Hat Single Sign-On 7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |