Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 9

Fixed packages 2

Vulnerabilities 2

• High 7.7
  CVE-2024-8698 Public exploit Scanner template

  Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak

  A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven
  Sep 19, 2024
• Medium 6.1
  CVE-2024-8883 Scanner template

  Keycloak: vulnerable redirect uri validation results in open redirec

  A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be ex…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven
  Sep 19, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2311641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312511
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6880.json
• report
  https://access.redhat.com/security/cve/CVE-2024-8698
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8698
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8698
• report
  https://access.redhat.com/security/cve/CVE-2024-8883
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8883
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8883
• article
  https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java