Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9

Fixed packages 2

Vulnerabilities 2

• High 7.5
  CVE-2022-2232

  Keycloak: ldap injection on username input

  A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.

  Red Hat Red Hat Single Sign-On 7 org.keycloak:keycloak-services org.keycloak:keycloak-ldap-federation Maven
  Nov 14, 2024
• Medium 4.6
  CVE-2023-6927

  Keycloak: open redirect via "form_post.jwt" jarm response mode

  A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.

  Red Hat Red Hat Single Sign-On 7 RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 7 Maven
  Dec 18, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255027
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0096.json
• report
  https://access.redhat.com/security/cve/CVE-2022-2232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2096994
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2232
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2232
• report
  https://access.redhat.com/security/cve/CVE-2023-6927
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6927
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6927