Red Hat Single Sign On und Keycloak: Mehrere Schwachstellen ermöglicht Privilegieneskalation

Summary

Product

Vulnerabilities 2

• High 7.7
  CVE-2024-8698 Public exploit Scanner template

  Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak

  A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven
  Sep 19, 2024
• Medium 6.1
  CVE-2024-8883 Scanner template

  Keycloak: vulnerable redirect uri validation results in open redirec

  A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be ex…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven
  Sep 19, 2024

Revision history

1. 2025-05-14 #3

   Neue Updates von HITACHI aufgenommen

2. 2024-11-04 #2

   Neue Updates von Red Hat aufgenommen

3. 2024-09-19 #1

   Initiale Fassung

References

• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6878
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6879
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6880
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6882
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6886
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6887
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6888
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6889
• Red Hat Security Advisory vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6890
• Red Hat Security Advisory RHSA-2024:8826 vom 2024-11-04
  https://access.redhat.com/errata/RHSA-2024:8826
• Red Hat Security Advisory RHSA-2024:8824 vom 2024-11-04
  https://access.redhat.com/errata/RHSA-2024:8824
• Red Hat Security Advisory RHSA-2024:8823 vom 2024-11-04
  https://access.redhat.com/errata/RHSA-2024:8823
• Hitachi Vulnerability Information HITACHI-SEC-2025-113 vom 2025-05-15
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-113/index.html