Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Cross-Site Scripting (XSS)-Angriffe durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.
Product
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Vulnerabilities 9
-
High 8.1
Keycloak: path transversal in redirection validation
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduc…
-
High 7.4
Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applicati…
-
High 7.1
Keycloak: path traversal in the redirect validation
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It…
-
Medium 6.5
Keycloak: session hijacking via re-authentication
A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=log…
-
Medium 6.0
Keycloak: xss via assertion consumer service url in saml post-binding flow
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malici…
-
Medium 5.4
Keycloak: authorization bypass
A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an envi…
-
Medium 5.3
Keycloak: log injection during webauthn authentication or registration
A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.
-
Medium 5.0
Keycloak: secondary factor bypass in step-up authentication
A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an ex…
-
Low 3.4
Keycloak: impersonation via logout token exchange
A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of e…
Revision history
-
#7
Neue Updates von HITACHI aufgenommen
-
#6
Neue Updates von Red Hat aufgenommen
-
#5
Neue Updates von Red Hat aufgenommen
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Security Advisory vom 2024-04-16
https://access.redhat.com/errata/RHSA-2024:1867
-
Red Hat Security Advisory vom 2024-04-16
https://access.redhat.com/errata/RHSA-2024:1868
-
Red Hat Security Advisory RHSA-2024:2945 vom 2024-05-21
https://access.redhat.com/errata/RHSA-2024:2945
-
Red Hat Security Advisory RHSA-2024:3752 vom 2024-06-10
https://access.redhat.com/errata/RHSA-2024:3752
-
RedHat Security Advisory
https://access.redhat.com/errata/RHSA-2024:3919
-
Red Hat Security Advisory RHSA-2024:3989 vom 2024-06-20
https://access.redhat.com/errata/RHSA-2024:3989
-
Red Hat Security Advisory RHSA-2024:4057 vom 2024-06-24
https://access.redhat.com/errata/RHSA-2024:4057
-
Hitachi Vulnerability Information HITACHI-SEC-2024-152 vom 2024-12-17
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-152/index.html