Skip to content
OpenAdvisories
Medium RHSA-2018:3592 5 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak-server 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6

Vulnerabilities 5

  • Medium 6.1
    CVE-2018-14637

    Improper Authentication in Keycloak

    The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.

    [UNKNOWN] keycloak org.keycloak:keycloak-core Maven
  • Medium 6.1
    CVE-2018-14658

    Keycloak Open Redirect

    A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

    Red Hat keycloak org.keycloak:keycloak-core Maven
  • Medium 5.4
    CVE-2018-10894

    Keycloak Authentication Error

    It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

    Red Hat keycloak org.keycloak:keycloak-services org.keycloak:keycloak-saml-adapter-core Maven
  • Medium 5.4
    CVE-2018-14657

    Keycloak Improper Bruteforce Detection

    A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 4.6
    CVE-2018-14655

    Keycloak vulnerable to cross-site scripting via the state parameter

    A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

    Red Hat keycloak org.keycloak:keycloak-parent Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign_on/?version=7.2
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1599434
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1625396
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1625404
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1625409
  • article
    https://issues.redhat.com/browse/JBEAP-15587
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3592.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-10894
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-10894
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-10894
  • report
    https://access.redhat.com/security/cve/CVE-2018-14637
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1627851
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-14637
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-14637
  • report
    https://access.redhat.com/security/cve/CVE-2018-14655
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-14655
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-14655
  • report
    https://access.redhat.com/security/cve/CVE-2018-14657
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-14657
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-14657
  • report
    https://access.redhat.com/security/cve/CVE-2018-14658
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-14658
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-14658