Red Hat Single Sign On: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 5

• High 8.1
  CVE-2024-1132

  Keycloak: path transversal in redirection validation

  A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduc…

  Red Hat Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 7 Red Hat Fuse 7 Maven
  Apr 17, 2024
• High 7.5
  CVE-2024-1635

  Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

  A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the…

  Red Hat Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Debian Ubuntu Maven
  Feb 19, 2024
• High 7.4
  CVE-2024-1249

  Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

  A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applicati…

  Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 Red Hat JBoss Enterprise Application Platform 7 Maven
  Apr 17, 2024
• Medium 5.4
  CVE-2023-6544

  Keycloak: authorization bypass

  A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an envi…

  Red Hat RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat Single Sign-On 7.6 for RHEL 7 Maven
  Apr 25, 2024
• Medium 5.3
  CVE-2023-6484

  Keycloak: log injection during webauthn authentication or registration

  A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

  Red Hat Red Hat Single Sign-On 7 RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 7 Maven
  Apr 25, 2024

Revision history

1. 2025-06-24 #5

   Neue Updates von Red Hat aufgenommen

2. 2025-04-27 #4

   Neue Updates von Red Hat aufgenommen

3. 2024-06-13 #3

   Neue Updates von Red Hat aufgenommen

4. 2024-06-10 #2

   Neue Updates von Red Hat aufgenommen

5. 2024-04-16 #1

   Initiale Fassung

References

• Red Hat Security Advisory vom 2024-04-16
  https://access.redhat.com/errata/RHSA-2024:1860
• Red Hat Security Advisory vom 2024-04-16
  https://access.redhat.com/errata/RHSA-2024:1861
• Red Hat Security Advisory vom 2024-04-16
  https://access.redhat.com/errata/RHSA-2024:1862
• Red Hat Security Advisory vom 2024-04-16
  https://access.redhat.com/errata/RHSA-2024:1864
• Red Hat Security Advisory vom 2024-04-16
  https://access.redhat.com/errata/RHSA-2024:1865
• Red Hat Security Advisory vom 2024-04-16
  https://access.redhat.com/errata/RHSA-2024:1866
• Red Hat Security Advisory RHSA-2024:3762 vom 2024-06-10
  https://access.redhat.com/errata/RHSA-2024:3762
• RedHat Security Advisory
  https://access.redhat.com/errata/RHSA-2024:3919
• Red Hat Security Advisory RHSA-2025:4226 vom 2025-04-28
  https://access.redhat.com/errata/RHSA-2025:4226
• Red Hat Security Advisory RHSA-2025:9583 vom 2025-06-25
  https://access.redhat.com/errata/RHSA-2025:9583
• Red Hat Security Advisory RHSA-2025:9582 vom 2025-06-25
  https://access.redhat.com/errata/RHSA-2025:9582