Repository navigation
Replies: 5 comments
|
Regarding This is already patched in nightly as far as I can tell. Patch commit: 5ef7e07 But the latest Keycloak release version |
|
I'm asking me did keycloak have no automatic security scanning for the containers in place like grype? |
|
A scanner report is useful input, but it is not the same as a fix plan. Some of these may be transitive dependencies, inherited from Quarkus, the base image, or dependency alignment choices. A version bump that looks simple in the report may not be safe or even possible directly in Keycloak. The stronger case would be to show which findings are reachable in Keycloak, which are direct dependencies, which are fixed upstream, and which can be resolved by a safe PR. If any of these are straightforward, a patch proving that would probably be more useful than asking why maintainers did not just run the same scanner. |
|
Here's the new report for recently released 26.6.2 - improvement is noticeable, mostly netty related vulnerabilities remain which is a transitive dependency coming from Quarkus runtime.
|
|
We're actively scanning for vulnerabilities in dependencies and fixing these as soon as we can; libcap for instance is already resolved by automatic re-spinning of the containers, while the Netty issues as mentioned before required a Quarkus release, and we will very soon do a new release of Keycloak that includes these. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I am currently upgrading from Keycloak 26.0.x to 26.6.1, one of the motivations being to eliminate critical and high-level vulnerabilities in the Keycloak image. However, according to the JFrog Xray scan report, several vulnerabilities remain present in the latest Keycloak image.
Are there any plans to address these vulnerabilities?
From the looks of it, these vulnerabilities shoud be relatively straightforward to resolve by upgrading minor/patch dependency versions. For the OpenJDK related vulnerabilities as I understand there's no fix yet.
All reactions