Skip to content
OpenAdvisories
Critical RHSA-2022:1712 1 CVE

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 8

Published Sep 16, 2024 · Updated Sep 22, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.5::el8 rh-sso7-keycloak 0:15.0.6-1.redhat_00002.1.el8sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.5::el8 rh-sso7-keycloak-server 0:15.0.6-1.redhat_00002.1.el8sso

Vulnerabilities 1

  • Critical 9.8
    CVE-2022-1245

    Keycloak vulnerable to privilege escalation on Token Exchange feature

    A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a…

    org.keycloak:keycloak-services Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html/release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2071036
  • article
    https://issues.redhat.com/browse/CIAM-2832
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1712.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-1245
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-1245
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-1245
  • article
    https://github.com/keycloak/keycloak/security/advisories/GHSA-75p6-52g3-rqc8