Red Hat Security Advisory: Red Hat Single Sign-On 7.6.8 enhancement and security update on RHEL 7

Fixed packages 2

Vulnerabilities 5

• High 8.1
  CVE-2024-1132

  Keycloak: path transversal in redirection validation

  A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduc…

  Red Hat Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 7 Red Hat Fuse 7 Maven
  Apr 17, 2024
• High 7.5
  CVE-2024-1635

  Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

  A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the…

  Red Hat Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Debian Ubuntu Maven
  Feb 19, 2024
• High 7.4
  CVE-2024-1249

  Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

  A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applicati…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 7 Maven
  Apr 17, 2024
• Medium 5.4
  CVE-2023-6544

  Keycloak: authorization bypass

  A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an envi…

  Red Hat RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat Single Sign-On 7.6 for RHEL 7 Maven
  Apr 25, 2024
• Medium 5.3
  CVE-2023-6484

  Keycloak: log injection during webauthn authentication or registration

  A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

  Red Hat Red Hat Single Sign-On 7 RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 7 Maven
  Apr 25, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253116
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262117
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2264928
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1860.json
• report
  https://access.redhat.com/security/cve/CVE-2023-6484
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6484
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6484
• advisory
  https://github.com/advisories/GHSA-j628-q885-8gr5
• report
  https://access.redhat.com/security/cve/CVE-2023-6544
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6544
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6544
• report
  https://access.redhat.com/security/cve/CVE-2024-1132
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1132
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1132
• report
  https://access.redhat.com/security/cve/CVE-2024-1249
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1249
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1249
• report
  https://access.redhat.com/security/cve/CVE-2024-1635
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1635
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1635