Repository navigation
Known CVEs in Keycloak #15188
|
Is there a list of known CVEs in Keycloak? I was checking regarding the CVE https://nvd.nist.gov/vuln/detail/CVE-2022-42889, but cannot find details anywhere. And is the list maintained for RedHat keycloak version here https://www.cvedetails.com/vulnerability-list/vendor_id-25/product_id-46161/Redhat-Keycloak.html valid for the image hosted at https://quay.io/repository/keycloak/keycloak? |
Replies: 4 comments
|
I've got the same question. We are currently at Keycloak 11 and are wondering if CVE-2022-42889 is going to be a problem for this version. |
|
I posted the same question on discourse at https://keycloak.discourse.group/t/list-of-known-cves-in-keycloak/18278/3 , there are some updates there. |
|
I have searched the github repo for: "StringSubstitutor" and "org.apache.commons.text" and no results. So I would say it is not affected - but I would like to hear the confirmation from some contributors. @stianst can you confirm that? |
|
@sirishkumar yes, CVEs fixes are planned by milestones and will be available in the upcoming releases. For more information, please see our list of issues: https://github.com/keycloak/keycloak/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3Akind%2Fcve. For Keycloak CVEs, public advisories are published on every Keycloak release: https://github.com/keycloak/keycloak/security/advisories?state=published Our team recently updated most of its dependency and this should be reflected by scanning the nightly images, and they should be part of upcoming releases: |
@sirishkumar yes, CVEs fixes are planned by milestones and will be available in the upcoming releases. For more information, please see our list of issues: https://github.com/keycloak/keycloak/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3Akind%2Fcve. For Keycloak CVEs, public advisories are published on every Keycloak release: https://github.com/keycloak/keycloak/security/advisories?state=published
Our team recently updated most of its dependency and this should be reflected by scanning the nightly images, and they should be part of upcoming releases: