Red Hat Security Advisory

RHSA-2023:7857

Red Hat Single Sign-On 7.6.6 for OpenShift image enhancement and security update

Released 2023-12-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Middleware Containers for OpenShift rh-sso-7/sso7-rhel8-operator-bundle, rh-sso-7/sso76-openshift-rhel8

Fixes 3 records

TI-2023-06014 CVE-2023-6563 · GHSA-54f3-c6hg-865h

Keycloak: offline session token dos

LOW 36

An unconstrained memory consumption vulnerability was discovered in Keycloak.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01239 Published 2023-12-14 Fixed in 18.0.11-2.redhat_00003.1.el7sso, 18.0.11-2.redhat_00003.1.el8sso +4 CWE-770

TI-2023-05774 CVE-2023-6291 · GHSA-mpwq-j3xf-7m5w

Keycloak: redirect_uri validation bypass

LOW 33

A flaw was found in the redirect_uri validation logic in Keycloak.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0095 Published 2024-01-26 Partial fix · 22.0.7-1, 22-6 +11 CWE-601

TI-2023-05639 CVE-2023-6134 · GHSA-cvg2-7c3j-g36j

Keycloak: reflected xss via wildcard in oidc redirect_uri

LOW 27

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01318 Published 2023-12-14 Fixed in 22.0.7-1, 22-6 +11 CWE-79