List of Keycloak CVEs

nvd.nist.gov

Private JIRA Issues

15.0.2

Changelog

15.0.1

Changelog

15.0.0

Changelog

14.0.0

Changelog

13.0.1

Changelog

13.0.0

Changelog

12.0.4

Changelog

12.0.3

Changelog

12.0.2

Changelog

12.0.1

Changelog

12.0.0

Changelog

11.0.3

Changelog

11.0.2

Changelog

11.0.1

Changelog

11.0.0

Changelog

10.0.2

Changelog

10.0.1

Changelog

10.0.0

Changelog

9.0.3

Changelog

9.0.2

Changelog

9.0.1

There is no 9.0.1 tag (anymore).

9.0.0

Changelog

8.0.2

Changelog

8.0.1

Changelog

Misq

Why?

The Keycloak maintainers do not announce security fixes (Like for every rule there are exceptions). So to identify the criticality of an update you have to check all the changes in the git repository and try to find out which of them a security fixes. But the Keycloak team makes their JIRA issues private, if they are about security issues. That allows us to correlate git commits with JIRA issues that are private. I miss this list on every Keycloak update. So I decided to do this myself. My goal is to enable others to better decide if they need to update their Keycloak instances.

Is every private issue a security issue?

I do not think so. There could also be other reasons to make an issue private. But I do not know. I am not able to check that. I expect that there will be private issues that are not security issues.

Are there security issues that are public?

I think so. One could argue that for example every Wildfly update is a security fix in some way. There also might other issues that fixes vulnerabilities, but that are public.

So which updates should I apply?

All of them. But test them properly. The .0 releases are huge sometimes and the .1 releases often contain fixes for the previous ones.

This is irresponsible!

As so often there is a problem with the dual-use security dilemma. But I do not publish new research or exploits. In the end I only gather some public information. This can be done by anyone with beginner level bash, git and curl skills. As someone responsible for Keycloak instances I rate the value for me higher than for attackers.

Are there any further informations about security and Keycloak?

First there is the Threat Model Mitigation part of the official Keycloak docs. This is their "Hardening Guide". Then there is the Keycloak - CNCF Security SIG - Self Assessment. While the submissin process is stuck for a while now the document definitely is worth a read. Third there is the report of a security assessment of Keycloak version 8.0.0 executed by Cure53 funded by REWE digital (Disclaimer: I have been involved in the assessment).