CVE-2022-21449 - Psychic Signatures in Java

[abstractj]

Last week, the security researcher Neil Madden published in his blog post all the details about how to exploit the recently disclosed vulnerability from CVE-2022-21449 due to improper implementation of ECDSA algorithm introduced in Java 15.

The ECDSA algorithm is used on Keycloak as part of OIDC and WebAuthN implementations. Keycloak server supports Java 11 only, and it is not impacted by this vulnerability.

Any Java clients using Keycloak adapters, or other libraries, in combination with ECDSA signed tokens may also be affected if using Java 15+.

We highly recommend anyone leveraging ECDSA signed tokens with Java 15+, or are running Keycloak server with Java 15+ to upgrade Java immediately.

The Keycloak team will continue to monitor the situation with CVE-2022-21449. Please reach us out in the Keycloak Security mailing list for additional concerns.

Additional resources

• Oracle Critical Patch Update Advisory

• OpenJDK Vulnerability Advisory

[abstractj]

@stianst FYI

[stianst]

@abstractj thanks, I made some minor adjustments.