CVE-2019-3875

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-12 · updated 2026-06-17
Weakness: CWE-295

Description

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.

Affected products

Keycloak: before 6.0.2 — fixed in 6.0.2
Red Hat Single Sign-On: 7.3

How to fix

Upgrade to a fixed version: Keycloak 6.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3875 or the next vulnerability affects your stack