Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9

Fixed packages 2

Vulnerabilities 2

• Critical 9.1
  CVE-2022-3782 Public exploit

  Keycloak vulnerable to path traversal via double URL encoding

  keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and pote…

  redhat.com Keycloak org.keycloak:keycloak-parent Maven
  Jan 11, 2023
• Medium 6.8
  CVE-2022-3916

  Keycloak: session takeover with oidc offline refreshtokens

  A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authenticatio…

  Red Hat Red Hat Single Sign-On 7 RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 8 Maven
  Sep 20, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2138971
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2141404
• article
  https://issues.redhat.com/browse/CIAM-4414
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8963.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3782
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3782
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3782
• report
  https://access.redhat.com/security/cve/CVE-2022-3916
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3916
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3916