Red Hat Security Advisory

RHSA-2022:8963

Red Hat Single Sign-On 7.6.1 security update on RHEL 9

Released 2022-12-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el9sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00002.1.el9sso

Fixes 2 records

TI-2022-03468 CVE-2022-3782 · GHSA-g8q8-fggx-9r3q

Path traversal in Red Hat Keycloak

MEDIUM 56

keycloak: path traversal via double URL encoding.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05953 Published 2023-01-11 Partial fix · 20.0.2 CWE-22

TI-2022-03591 CVE-2022-3916 · GHSA-97g8-xfvw-q4hg

Keycloak: session takeover with oidc offline refreshtokens

LOW 34

A flaw was found in the offline_access scope in Keycloak.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00952 Published 2023-09-20 Fixed in 18.0.3-1.redhat_00002.1.el7sso, 18.0.6-1.redhat_00001.1.el7sso +7 CWE-384