Keycloak: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• Medium 6.5
  CVE-2024-10270

  Org.keycloak:keycloak-services: keycloak denial of service

  A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8 Maven
  Nov 25, 2024
• Medium 5.9
  CVE-2024-10451

  Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process

  A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, se…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat build of Keycloak 26.0 Maven
  Nov 25, 2024
• Medium 4.7
  CVE-2024-9666

  Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability

  A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such …

  Red Hat Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Red Hat build of Keycloak 26.0 Maven
  Nov 25, 2024
• Low 2.7
  CVE-2024-10492

  Keycloak-quarkus-server: keycloak path trasversal

  A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource cre…

  Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8 Maven
  Nov 25, 2024

Revision history

1. 2025-09-22 #3

   Neue Updates von Red Hat aufgenommen

2. 2025-05-14 #2

   Neue Updates von HITACHI aufgenommen

3. 2024-11-21 #1

   Initiale Fassung

References

• RedHat Customer Portal vom 2024-11-21
  https://access.redhat.com/security/cve/CVE-2024-9666
• RedHat Customer Portal vom 2024-11-21
  https://access.redhat.com/security/cve/CVE-2024-10039
• RedHat Customer Portal vom 2024-11-21
  https://access.redhat.com/security/cve/CVE-2024-10270
• RedHat Customer Portal vom 2024-11-21
  https://access.redhat.com/security/cve/CVE-2024-10451
• RedHat Customer Portal vom 2024-11-21
  https://access.redhat.com/security/cve/CVE-2024-10492
• Keycloak Release Notes vom 2024-11-21
  https://www.keycloak.org/2024/10/keycloak-2601-released
• Keycloak Release Notes vom 2024-11-21
  https://www.keycloak.org/2024/10/keycloak-2602-released
• Keycloak Release Notes vom 2024-11-21
  https://www.keycloak.org/2024/11/keycloak-2605-released
• Keycloak Release Notes vom 2024-11-21
  https://www.keycloak.org/2024/11/keycloak-2606-released
• Red Hat Security Advisory vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:10175
• Red Hat Security Advisory vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:10176
• Red Hat Security Advisory vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:10177
• Red Hat Security Advisory vom 2024-11-21
  https://access.redhat.com/errata/RHSA-2024:10178
• Hitachi Vulnerability Information HITACHI-SEC-2025-113 vom 2025-05-15
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-113/index.html
• Red Hat Security Advisory RHSA-2025:16400 vom 2025-09-22
  https://access.redhat.com/errata/RHSA-2025:16400
• Red Hat Security Advisory RHSA-2025:16399 vom 2025-09-22
  https://access.redhat.com/errata/RHSA-2025:16399