List of known CVEs in Keycloak

1

Is there a list of known CVEs in Keycloak? I was checking regarding the CVE NVD - CVE-2022-42889, but cannot find details anywhere.

And is the list maintained for RedHat keycloak version here Redhat Keycloak : List of security vulnerabilities valid for the image hosted at Quay? And also it does contain known vulnerabilities in version 19 onwards(Versions of Redhat Keycloak : Versions and number of related security vulnerabilities)

I tried raising this issue in GitHub forums, but did not get any reply.

2

I feel it is safe to say that there isn’t a single list of all known CVEs in Keycloak and all of it’s included dependencies.

1 Like
3

As for a secure deployment you typcially want to build your own version anyway, take a look at e.g. GitHub - thomasdarimont/keycloak-custom-server: Custom Keycloak.X Server Distribution with selective features to see how to just build a CVE-free version.

1 Like