CVE-2020-35509: 
Java vulnerability analysis and mitigation

A security vulnerability (CVE-2020-35509) was discovered in Keycloak versions 11.0.3 and 12.0.0. The flaw involves the X509 Direct Grant Authentication mechanism failing to properly validate certificate timestamps, which could result in expired certificates being accepted by the direct-grant authenticator (Red Hat Portal).

The vulnerability specifically affects the X509 Direct Grant Authentication component in Keycloak, where the system fails to perform proper timestamp validations on certificates. This security flaw was rated as having a Moderate severity impact by Red Hat Product Security (RHSA-2021:3529).

The vulnerability could allow the acceptance of expired certificates during the authentication process, potentially compromising the security of the authentication mechanism (NVD).

The vulnerability was addressed in Red Hat Single Sign-On 7.4.9, which serves as a replacement for version 7.4.8. The fix was included as part of a security update package (RHSA-2021:3534).

The vulnerability has been fixed in Red Hat Single Sign-On 7.4.9. Users are advised to upgrade to this version to address the security issue. Before applying the update, it is recommended to back up existing installations, including all applications, configuration files, databases, and database settings (RHSA-2021:3534).