CVE-2019-3875

CVE-2019-3875 is a vulnerability in Keycloak versions prior to 6.0.2, and Red Hat Single Sign-On, where the X.509 authenticator fails to validate signatures on Certificate Revocation Lists (CRLs). This oversight, particularly when CRLs are retrieved via unsecured protocols like HTTP or LDAP, creates a risk of man-in-the-middle attacks. The vulnerability has a CVSS score of 4.8 (Medium), indicating a network-based attack with high attack complexity, potentially leading to low confidentiality and integrity impacts. There is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB, and it has garnered minimal community discussion or media coverage.