Repository navigation
Clarification on GHSA-hw58-3793-42gg Vulnerability in Keycloak 24 #39823
Unanswered
gokulrajganesan2000
asked this question in
Q&A
Replies: 1 comment
|
I have same issue, is this vulnerability (GHSA-hw58-3793-42gg) applicable for Keycloak 24? If so, how? |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
The SSL certificate validation bypass (as described in GHSA-hw58-3793-42gg) appears to be introduced from Keycloak 25. In Keycloak 24, this behavior does not seem to be present, as there is no mechanism to disable SSL certificate validation in Keycloak 24.
Given this, should the GHSA-hw58-3793-42gg vulnerability still be considered applicable to Keycloak 24?
https://github.com/keycloak/keycloak/pull/39366/files
All reactions