Skip to content

v1.7.2

Choose a tag to compare

View all tags
@luisvillegasbf23 luisvillegasbf23 released this 14 Sep 09:42
· 2 commits to main since this release
v1.7.2
9310072
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🚨🚨IMPORTANT🚨🚨

A security issue was fixed related to the Keycloak configuration file, which included hardcoded cryptographic keys.

These keys are required to sign tokens. When they aren't specified in the configuration file, Keycloak generates them automatically at startup, using different values for each installation.

If your environment is already set up, mitigation is quick:

  1. Go to the Keycloak admin console.
  2. Go to Manage realms and select tero realm
  3. Go to Realm settings → Keys → Providers → Add provider and add the following 4 providers, all with Priority 200:
rsa-generated
rsa-enc-generated
aes-generated
hmac-generated
  1. Delete the 4 existing providers that have Priority 100 (the ones using the compromised keys).

Once the change is applied, it's important to notify users, since previously issued JWT tokens will be invalidated and their current sessions will fail, so they could lose the progress of whatever they're working on.

Assets 2
Loading