Repository navigation
Security Vulnerability Inquiry #46079
Unanswered
kushagratcs
asked this question in
Q&A
Replies: 1 comment
|
See https://www.keycloak.org/security Supported Versions. You should start by redoing your scan for a supported version - ideally the latest 26.5.2 as of this writing. For any remaining vulnerabilities, first search our issues to see if it is something that is already accounted for / scheduled for release. For anything else you can open a new issue. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Overview
We are developing a custom SPI extension for Keycloak and recently conducted a security vulnerability scan (using Anchore) on our container image based on
quay.io/keycloak/keycloak:26.2.5. The scan identified 38 vulnerabilities in Keycloak's transitive dependencies, and we're seeking guidance from the community and maintainers.Environment
quay.io/keycloak/keycloak:26.2.5/opt/keycloak/providers/Vulnerability Summary
Our security scan identified the following vulnerabilities in Keycloak's bundled dependencies:
Severity | Count | Primary CVEs -- | -- | -- CRITICAL | 9 | CVE-2022-37832 (7x), CVE-2019-20445, CVE-2019-20444 HIGH | 20 | CVE-2013-0136 (8x), CVE-2018-15529 (8x), CVE-2021-37136, CVE-2021-37137 MEDIUM | 9 | Various CVEs in gRPC Netty Total | 38 |Affected Libraries
1. Smallrye Mutiny Vert.x (Version 3.16.0) - 22 vulnerabilities
Modules affected:
smallrye-mutiny-vertx-runtimesmallrye-mutiny-vertx-coresmallrye-mutiny-vertx-websmallrye-mutiny-vertx-web-commonsmallrye-mutiny-vertx-auth-commonsmallrye-mutiny-vertx-uri-templatesmallrye-mutiny-vertx-bridge-commonKey CVEs:
2. Mutiny Core (Version 2.6.2) - 3 vulnerabilities
Key CVEs:
3. gRPC Netty (Version 1.65.1) - 15 vulnerabilities
Key CVEs:
4. OpenTelemetry Exporter (Version 1.39.0) - 2 vulnerabilities
Key CVEs:
Our Context
As SPI developers, we follow Keycloak best practices:
providedscope for all Keycloak dependenciesWe understand that:
Questions for the Community
False Positives: Are any of these CVEs known false positives when used within Keycloak's context?
Version Status: Are these vulnerabilities addressed in Keycloak 26.5.0 or a newer version?
Planned Updates: Is there a planned release that will include updated versions of these libraries?
Risk Assessment: Do these vulnerabilities pose actual security risks to Keycloak deployments, or are they theoretical in Keycloak's usage patterns?
Recommended Actions: What is the recommended approach for SPI developers encountering these scan results?
What We've Already Done
✅ Reviewed Keycloak Security Advisories - no mentions of these specific CVEs
Overview We are developing a custom SPI extension for Keycloak and recently conducted a security vulnerability scan (using Anchore) on our container image based on quay.io/keycloak/keycloak:26.2.5. The scan identified 38 vulnerabilities in Keycloak's transitive dependencies, and we're seeking guidance from the community and maintainers.✅ Checked recent release notes for dependency updates
✅ Searched existing issues and discussions (didn't find similar reports)
✅ Implemented infrastructure-level controls (network isolation, reverse proxy, firewalls)
✅ Verified we're following SPI development best practices
Environment
Keycloak Version: 26.2.5 (container base image)
Development Dependencies: 26.5.0
Base Image: quay.io/keycloak/keycloak:26.2.5
Deployment: Custom SPI JAR in /opt/keycloak/providers/
Scan Tool: Anchore Engine
Scan Date: [Insert Date]
Vulnerability Summary
Our security scan identified the following vulnerabilities in Keycloak's bundled dependencies:
Severity Count Primary CVEs
CRITICAL 9 CVE-2022-37832 (7x), CVE-2019-20445, CVE-2019-20444
HIGH 20 CVE-2013-0136 (8x), CVE-2018-15529 (8x), CVE-2021-37136, CVE-2021-37137
MEDIUM 9 Various CVEs in gRPC Netty
Total 38
Affected Libraries
Modules affected:
smallrye-mutiny-vertx-runtime
smallrye-mutiny-vertx-core
smallrye-mutiny-vertx-web
smallrye-mutiny-vertx-web-common
smallrye-mutiny-vertx-auth-common
smallrye-mutiny-vertx-uri-template
smallrye-mutiny-vertx-bridge-common
Key CVEs:
CVE-2022-37832 - CRITICAL (6 instances)
CVE-2013-0136 - HIGH (7 instances)
CVE-2018-15529 - HIGH (7 instances)
2. Mutiny Core (Version 2.6.2) - 3 vulnerabilities
Key CVEs:
CVE-2022-37832 - CRITICAL
CVE-2013-0136 - HIGH
CVE-2018-15529 - HIGH
3. gRPC Netty (Version 1.65.1) - 15 vulnerabilities
Key CVEs:
CVE-2019-20445 - CRITICAL
CVE-2019-20444 - CRITICAL
CVE-2021-37136 - HIGH
CVE-2021-37137 - HIGH
CVE-2019-16869 - HIGH
CVE-2015-2156 - HIGH
Plus 9 MEDIUM severity CVEs
4. OpenTelemetry Exporter (Version 1.39.0) - 2 vulnerabilities
Key CVEs:
CVE-2024-39657 - HIGH
CVE-2024-43126 - HIGH
Our Context
As SPI developers, we follow Keycloak best practices:
Using provided scope for all Keycloak dependencies
Explicitly excluding Keycloak-provided dependencies from our SPI JAR
Following the guidelines in the Keycloak Server Developer Guide
We understand that:
These are transitive dependencies from Keycloak's runtime
We cannot override them due to Keycloak's shared classloader architecture
Attempting to bundle or shade patched versions breaks Keycloak's plugin system
Questions for the Community
False Positives: Are any of these CVEs known false positives when used within Keycloak's context?
Especially older CVEs like CVE-2013-0136 and CVE-2015-2156
Version Status: Are these vulnerabilities addressed in Keycloak 26.5.0 or a newer version?
Planned Updates: Is there a planned release that will include updated versions of these libraries?
Risk Assessment: Do these vulnerabilities pose actual security risks to Keycloak deployments, or are they theoretical in Keycloak's usage patterns?
Recommended Actions: What is the recommended approach for SPI developers encountering these scan results?
Should we suppress them in our security policies?
Are there specific mitigation strategies?
Is upgrading to a newer Keycloak version the only option?
What We've Already Done
✅ Reviewed Keycloak Security Advisories - no mentions of these specific CVEs
✅ Checked recent release notes for dependency updates
✅ Searched existing issues and discussions (didn't find similar reports)
✅ Implemented infrastructure-level controls (network isolation, reverse proxy, firewalls)
✅ Verified we're following SPI development best practices
All reactions