Flaw found in Infinispan (10.0.0 through 12.0.0) where an attacker can bypass authentication on REST endpoints with DIGEST authentication:
Bug 1955113 (CVE-2021-31917)
https://bugzilla.redhat.com/show_bug.cgi?id=1955113
Keycloak 16.x uses infinispan 12.1.7
Keycloak 15.x uses infinispan 11.0.9
Keycloak 14.x uses infinispan 11.0.9
Keycloak 13.x uses infinispan 11.0.9
Keycloak 12.x uses infinispan 11.0.4
By default I don’t see DIGEST authentication in use, therefore I assume Keycloak 12-15 are not impacted.
Has anyone else looked at this?