Repository navigation
Replies: 2 comments 5 replies
|
I am neither a Keycloak dev nor a Java developer in general but a Keycloak user. From what I know, the CVE is in the Java Runtime, so it depends on your deployment model.
But I'd also really appreciate an "official" response. |
|
As per https://openjdk.java.net/groups/vulnerability/advisories/2022-04-19, the vulnerability also affects Java 11.0.14 or earlier. |
|
The OpenJDK cumulative update addresses multiple CVEs. The one mentioned in this conversation (CVE-2022-21449, related to ECDSA signature) only affects OpenJDK 15+ |
|
@vanrar68 the advisory you linked to says "Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2.". Although it doesn't say "or earlier" like the cumulative update does. |
|
Actually I didn't link anything, just pasted the CVE string and Github picked it up and transformed it into a link to an internal advisory (related to Oracle products only). |
|
so, "no, OpenJDK11.x is not affected by CVE-2022-21449", BUT "yes, OpenJDK11.x is affected by OTHER CVEs, and so should be updated regardless"? Is that correct? |
Uh oh!
There was an error while loading. Please reload this page.
I was checking this post, https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/ and it mentions that it can affect signed JWTs and OIDC id tokens, so I wonder if it has any affect on keycloak as it uses java.
All reactions