Red Hat Security Advisory

RHSA-2023:3885

Red Hat Single Sign-On 7.6.4 security update on RHEL 9

Released 2023-06-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.8-1.redhat_00001.1.el9sso

Fixes 5 records

TI-2022-03994 CVE-2022-4361 · GHSA-3p62-6fjh-3p5h

Cross-site scripting in keycloak

MEDIUM 50

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00691 Published 2023-07-07 Fixed in 21.1.2 CWE-81

TI-2023-02415 CVE-2023-2585 · GHSA-f5h4-wmp5-xhg6

Keycloak: client access via device auth request spoof

LOW 36

Keycloak's device authorization grant does not correctly validate the device code and client ID.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00694 Published 2023-12-21 Fixed in 18.0.8-1.redhat_00001.1.el7sso, 18.0.8-1.redhat_00001.1.el8sso +3 CWE-358

TI-2023-01048 CVE-2023-1108 · GHSA-m4mm-pg93-fv78

Undertow: infinite loop in sslconduit during close

LOW 36

A flaw was found in undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01771 Published 2023-09-14 Partial fix · 2.3.5, 2.2.24 +18 CWE-835

TI-2023-01561 CVE-2023-1664 · GHSA-5cc8-pgp5-7mpm

Improper certificate validation in Keycloak

LOW 35

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00425 Published 2023-05-26 Partial fix · 21.1.2 CWE-295

TI-2023-02276 CVE-2023-2422 · GHSA-3qh5-qqj2-c78f

Keycloak: oauth client impersonation

LOW 32

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00522 Published 2023-10-04 Fixed in 18.0.8-1.redhat_00001.1.el7sso, 18.0.8-1.redhat_00001.1.el8sso +3 CWE-295