Red Hat Security Advisory

RHSA-2024:1862

Red Hat Single Sign-On 7.6.8 security update on RHEL 9

Released 2024-04-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.13-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.13-1.redhat_00001.1.el9sso

Fixes 5 records

TI-2024-01049 CVE-2024-1132 · GHSA-72vp-xfrc-42xm

Keycloak: path transversal in redirection validation

HIGH 70

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01552 Published 2024-04-17 Partial fix · 22.0.10, 24.0.3 +12 CWE-22

TI-2024-01518 CVE-2024-1635 · GHSA-w6qf-42m7-vh68

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

MEDIUM 40

A vulnerability was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04572 Published 2024-02-19 Partial fix · 1.5.5.016-1.redhat_00001.1.ep7.el7, 1:1.5.5.016-1.redhat_00001.1.ep7.el7 +24 CWE-400

TI-2024-01163 CVE-2024-1249 · GHSA-m6q9-p373-g5q8

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

LOW 33

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00448 Published 2024-04-17 Partial fix · 22.0.10, 24.0.3 +9 CWE-346

TI-2023-05942 CVE-2023-6484 · GHSA-j628-q885-8gr5

Keycloak: log injection during webauthn authentication or registration

LOW 32

A log injection flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01008 Published 2024-04-25 Fixed in 22.0.9, 23.0.5 +14 CWE-117

TI-2023-05996 CVE-2023-6544 · GHSA-46c8-635v-68r2

Keycloak: authorization bypass

LOW 27

A flaw was found in the Keycloak package.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01075 Published 2024-04-25 Fixed in 22.0.10, 24.0.3 +7 CWE-625