Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 | eap8-eap-product-conf-parent | 0:800.4.1-1.GA_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 | eap8-eap-product-conf-wildfly-ee-feature-pack | 0:800.4.1-1.GA_redhat_00001.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 | eap8-wildfly | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 | eap8-wildfly-java-jdk11 | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 | eap8-wildfly-java-jdk17 | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 | eap8-wildfly-java-jdk21 | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el8 | eap8-wildfly-modules | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9 | eap8-eap-product-conf-parent | 0:800.4.1-1.GA_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9 | eap8-eap-product-conf-wildfly-ee-feature-pack | 0:800.4.1-1.GA_redhat_00001.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9 | eap8-wildfly | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9 | eap8-wildfly-java-jdk11 | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9 | eap8-wildfly-java-jdk17 | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9 | eap8-wildfly-java-jdk21 | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
| Red Hat · JBoss EAP 8 jboss_enterprise_application_platform:8.0::el9 | eap8-wildfly-modules | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
Vulnerabilities 1
-
Medium 6.1CVE-2024-8883 Scanner template
Keycloak: vulnerable redirect uri validation results in open redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be ex…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/
-
article
https://access.redhat.com/articles/7090605
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2312511
-
article
https://issues.redhat.com/browse/JBEAP-28488
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10386.json
-
report
https://access.redhat.com/security/cve/CVE-2024-8883
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-8883
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-8883
-
article
https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java