Red Hat Single Sign On: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 10.0
  CVE-2022-4361 Public exploit

  Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

  Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL val…

  Keycloak Keycloak org.keycloak:keycloak-services Maven
  Jul 7, 2023
• High 7.5
  CVE-2023-1108

  Undertow: infinite loop in sslconduit during close

  A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Debian Ubuntu Maven
  Sep 14, 2023

Revision history

1. 2025-04-27 #2

   Neue Updates von Red Hat aufgenommen

2. 2023-06-27 #1

   Initiale Fassung

References

• RedHat Security Advisory vom 2023-06-27
  https://access.redhat.com/errata/RHSA-2023:3883
• RedHat Security Advisory vom 2023-06-27
  https://access.redhat.com/errata/RHSA-2023:3884
• RedHat Security Advisory vom 2023-06-27
  https://access.redhat.com/errata/RHSA-2023:3885
• RedHat Security Advisory vom 2023-06-27
  https://access.redhat.com/errata/RHSA-2023:3888
• RedHat Security Advisory vom 2023-06-27
  https://access.redhat.com/errata/RHSA-2023:3892
• Red Hat Security Advisory RHSA-2025:4226 vom 2025-04-28
  https://access.redhat.com/errata/RHSA-2025:4226