Red Hat Security Advisory

RHSA-2024:0799

Red Hat Single Sign-On 7.6.7 security update on RHEL 8

Released 2024-02-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el8sso

Fixes 8 records

TI-2023-11282 CVE-2023-26048 · GHSA-qw69-rqj8-6qw8

OutOfMemoryError for large multipart without filename in Eclipse Jetty

LOW 36

Jetty is a java based web server and servlet engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03369 Published 2023-04-18 Partial fix · 9.4.51, 10.0.14 +2 CWE-400

TI-2023-05774 CVE-2023-6291 · GHSA-mpwq-j3xf-7m5w

Keycloak: redirect_uri validation bypass

LOW 33

A flaw was found in the redirect_uri validation logic in Keycloak.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0095 Published 2024-01-26 Partial fix · 22.0.7-1, 22-6 +11 CWE-601

TI-2023-02788 CVE-2023-2976 · GHSA-7g45-4rm6-3mm3

Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

LOW 33

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00248 Published 2023-06-14 Partial fix · 32.0.0, 32.0.0-android CWE-552

TI-2023-23977 CVE-2023-44483 · GHSA-xfrj-6vvc-3xm2

Apache Santuario: Private Key disclosure in debug-log output

LOW 32

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML S…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01547 Published 2023-10-20 Partial fix · 2.2.6, 2.3.4 +1 CWE-532

TI-2023-05942 CVE-2023-6484 · GHSA-j628-q885-8gr5

Keycloak: log injection during webauthn authentication or registration

LOW 32

A log injection flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01008 Published 2024-04-25 Fixed in 22.0.9, 23.0.5 +14 CWE-117

TI-2023-06330 CVE-2023-6927 · GHSA-9vm7-v8wj-3fqw

Keycloak: open redirect via "form_post.jwt" jarm response mode

LOW 29

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01109 Published 2023-12-18 Fixed in 22-7, 18.0.11-3.redhat_00001.1.el7sso +8 CWE-601

TI-2023-11283 CVE-2023-26049 · GHSA-p26g-97m4-6q7c

Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

LOW 27

Jetty is a java based web server and servlet engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.013 Published 2023-04-18 Partial fix · 9.4.51, 10.0.14 +3 CWE-200

TI-2023-05639 CVE-2023-6134 · GHSA-cvg2-7c3j-g36j

Keycloak: reflected xss via wildcard in oidc redirect_uri

LOW 27

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01318 Published 2023-12-14 Fixed in 22.0.7-1, 22-6 +11 CWE-79