Summary
Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um falsche Informationen darzustellen um die Authentifizierung zu umgehen.
Product
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Vulnerabilities 3
-
High 7.1
Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks t…
-
Medium 6.1
Keycloak-core: open redirect on account page
An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing …
-
Medium 4.8
Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seco…
Revision history
-
#2
Neue Updates von HITACHI aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Security Advisory vom 2024-09-09
https://access.redhat.com/errata/RHSA-2024:6502
-
Red Hat Security Advisory vom 2024-09-09
https://access.redhat.com/errata/RHSA-2024:6503
-
Hitachi Vulnerability Information HITACHI-SEC-2024-152 vom 2024-12-17
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-152/index.html