Repository navigation
GHSA-q8hq-4h99-fj7x Not understanding the sense #43770
Unanswered
narofourty
asked this question in
Q&A
Replies: 1 comment 1 reply
Do you have a reference for that? Looking at the openjdk source, the default is false: https://github.com/openjdk/jdk/blob/jdk-21%2B35/src/java.base/share/classes/sun/security/ssl/ServerHandshakeContext.java#L40 |
1 reply
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I'm trying to understand the rationale for GHSA-q8hq-4h99-fj7x.
The advisory states the vulnerability is due to the "default JDK setting that permits Client-Initiated Renegotiation."
However, this seems contradictory to Keycloak's system requirements:
Affected Keycloak versions (e.g., 26.x) require Java 11 or Java 17+ to run.
All these modern JDKs (Java 11, 17, 21) set jdk.tls.rejectClientInitiatedRenGotiation=true by default.
Given this, it seems impossible to run affected Keycloak versions on a JVM where the insecure false setting is the default.
Is this vulnerability only valid if an administrator has explicitly overridden the JVM's secure default (e.g., by setting the flag to false)?
Why is this considered a high-severity (7.5) software vulnerability rather than an environment-specific misconfiguration?
Thank you.
All reactions