High RHSA-2024:6495 3 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 9

Published Sep 27, 2024 · Updated Aug 27, 2026

Ecosystem: Red Hat

Fixed packages 2

Release	Package	Fixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el9	rh-sso7-keycloak	0:18.0.16-1.redhat_00001.1.el9sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el9	rh-sso7-keycloak-server	0:18.0.16-1.redhat_00001.1.el9sso

Vulnerabilities 3

High 7.1

CVE-2024-7341

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks t…

Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven

Sep 9, 2024
Medium 6.5

CVE-2024-4629

Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts…

Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven

Sep 3, 2024
Low 2.7

CVE-2024-5967

Keycloak: leak of configured ldap bind credentials through the keycloak admin console

A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to …

Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak RHEL-8 based Middleware Containers Maven

Jun 18, 2024

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2276761
report
https://bugzilla.redhat.com/show_bug.cgi?id=2292200
report
https://bugzilla.redhat.com/show_bug.cgi?id=2302064
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6495.json
report
https://access.redhat.com/security/cve/CVE-2024-4629
advisory
https://www.cve.org/CVERecord?id=CVE-2024-4629
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-4629
report
https://access.redhat.com/security/cve/CVE-2024-5967
advisory
https://www.cve.org/CVERecord?id=CVE-2024-5967
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-5967
report
https://access.redhat.com/security/cve/CVE-2024-7341
advisory
https://www.cve.org/CVERecord?id=CVE-2024-7341
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-7341
advisory
https://github.com/advisories/GHSA-j76j-rqwj-jmvv