Repository navigation
Replies: 3 comments
|
check the keycloak jira for a tracking issue on the cve first — disclosed ones usually get one. then look at github milestones: fixes land in the next patch release, so the milestone tag tells you which version carries it. also watch the keycloak blog and announce list — they publish a security advisory when the fix ships, naming affected versions. if theres no tracking issue and no milestone, theres no public signal — maintainers stay quiet on security timelines until release, so asking wont surface much more. |
|
@aashish254 I don't see a Keycloak Jira instance. But searching for one gave me the closest thing to what I'm asking, this handy dashboard. |
|
Upstream Keycloak tracks this in GitHub issues; the Bugzilla entries are Red Hat's own product-security tracking. For a CVE that's already public: 1. Is a fix on the way? Search the issues for the CVE ID. Public CVEs usually get an issue labeled The bugs dashboard you found reads these same labels for its public tables. Its "CVEs per team – Private" table counts issues in the private security repository (reports still in triage plus confirmed CVEs still open), so it tells you how many are in progress, not which ones. On the issue, the labels carry the useful information:
Closed doesn't mean released: the issue closes when the fix merges to main, usually before the backports and the release. Check the Once the fix ships, it's listed under "Security fixes" in that release's notes (e.g. 26.8.1). For a scraper, the release notes plus the issue labels are the most complete source. GitHub Security Advisories exist for only a fraction of CVEs (see #48728), so a missing GHSA doesn't mean "not fixed". Only the latest minor gets community releases (26.8.x as of this writing). Backports to older branches like 26.6 are tagged in git but not published as community downloads, so upstream the fix arrives in the next 26.8.x or 27.0.0. 2. Contributing a patch The security charter's private repository is for newly reported, undisclosed vulnerabilities. Once a CVE has a public |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We use a CVE scraper to notify us about open Keycloak CVEs. Usually the CVEs are already fixed in a previous release, but sometimes they are not. In the case where the CVE shows up at https://nvd.nist.gov and has a corresponding ticket in https://bugzilla.redhat.com/, two questions arise.
I see at https://www.keycloak.org/security-charter a private repository and private review are typical, but that mostly makes sense in the case when the CVE has not already been disclosed. When the CVE is listed at https://nvd.nist.gov it would be good to know if a fix is on the way or not and/or whether patches are welcome.
All reactions