Action not permitted
Modal body text goes here.
CVE-2024-10451
Vulnerability from cvelistv5
Published
2024-11-25 07:37
Modified
2024-11-27 20:51
Severity ?
EPSS score ?
Summary
Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Red Hat | Red Hat build of Keycloak 24 |
Unaffected: 24.0.9-1 < * cpe:/a:redhat:build_keycloak:24::el9 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-10451", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-25T16:00:10.921097Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-25T16:00:38.099Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:build_keycloak:24::el9" ], "defaultStatus": "affected", "packageName": "rhbk/keycloak-operator-bundle", "product": "Red Hat build of Keycloak 24", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "24.0.9-1", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:build_keycloak:24::el9" ], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat build of Keycloak 24", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "24-18", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:build_keycloak:24::el9" ], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9-operator", "product": "Red Hat build of Keycloak 24", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "24-18", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:build_keycloak:24" ], "defaultStatus": "unaffected", "packageName": "org.keycloak/keycloak-quarkus-server", "product": "Red Hat build of Keycloak 24.0.9", "vendor": "Red Hat" }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:build_keycloak:26.0::el9" ], "defaultStatus": "affected", "packageName": "rhbk/keycloak-operator-bundle", "product": "Red Hat build of Keycloak 26.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "26.0.6-2", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:build_keycloak:26.0::el9" ], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat build of Keycloak 26.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "26.0-5", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:build_keycloak:26.0::el9" ], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9-operator", "product": "Red Hat build of Keycloak 26.0", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "26.0-6", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:build_keycloak:26" ], "defaultStatus": "unaffected", "packageName": "org.keycloak/keycloak-quarkus-server", "product": "Red Hat build of Keycloak 26.0.6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": [ "cpe:/a:redhat:jboss_enterprise_application_platform:8" ], "defaultStatus": "unaffected", "packageName": "org.keycloak/keycloak-quarkus-server", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:red_hat_single_sign_on:7" ], "defaultStatus": "unknown", "packageName": "org.keycloak/keycloak-quarkus-server", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat" } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Steven Hawkins for reporting this issue." } ], "datePublic": "2024-11-21T16:55:00+00:00", "descriptions": [ { "lang": "en", "value": "A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-798", "description": "Use of Hard-coded Credentials", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-27T20:51:51.757Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2024:10175", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:10175" }, { "name": "RHSA-2024:10176", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:10176" }, { "name": "RHSA-2024:10177", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:10177" }, { "name": "RHSA-2024:10178", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2024:10178" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2024-10451" }, { "name": "RHBZ#2322096", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" } ], "timeline": [ { "lang": "en", "time": "2024-10-28T07:27:41.800000+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2024-11-21T16:55:00+00:00", "value": "Made public." } ], "title": "Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process", "x_redhatCweChain": "CWE-798: Use of Hard-coded Credentials" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2024-10451", "datePublished": "2024-11-25T07:37:05.161Z", "dateReserved": "2024-10-28T07:34:31.748Z", "dateUpdated": "2024-11-27T20:51:51.757Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-10451\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2024-11-25T08:15:07.900\",\"lastModified\":\"2024-11-25T08:15:07.900\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una falla en Keycloak. Este problema ocurre porque los valores de tiempo de ejecuci\u00f3n confidenciales, como las contrase\u00f1as, pueden capturarse durante el proceso de compilaci\u00f3n de Keycloak e incorporarse como valores predeterminados en el c\u00f3digo de bytes, lo que genera una divulgaci\u00f3n de informaci\u00f3n no deseada. En Keycloak 26, los datos confidenciales especificados directamente en las variables de entorno durante el proceso de compilaci\u00f3n tambi\u00e9n se almacenan como valores predeterminados, lo que los hace accesibles durante el tiempo de ejecuci\u00f3n. El uso indirecto de las variables de entorno para las opciones de SPI y las propiedades de Quarkus tambi\u00e9n es vulnerable debido a la expansi\u00f3n incondicional por parte de la l\u00f3gica de PropertyMapper, que captura datos confidenciales como valores predeterminados en todas las versiones de Keycloak hasta la 26.0.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2024:10175\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:10176\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:10177\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:10178\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2024-10451\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2322096\",\"source\":\"secalert@redhat.com\"}]}}" } }
wid-sec-w-2024-3525
Vulnerability from csaf_certbund
Published
2024-11-21 23:00
Modified
2024-11-21 23:00
Summary
Keycloak: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Keycloak und Red Hat OpenShift ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen
Betroffene Betriebssysteme
- UNIX
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Keycloak erm\u00f6glicht Single Sign-On mit Identity and Access Management f\u00fcr moderne Anwendungen und Dienste.\r\nRed Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in Keycloak und Red Hat OpenShift ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen", "title": "Angriff" }, { "category": "general", "text": "- UNIX", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-3525 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3525.json" }, { "category": "self", "summary": "WID-SEC-2024-3525 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3525" }, { "category": "external", "summary": "RedHat Customer Portal vom 2024-11-21", "url": "https://access.redhat.com/security/cve/CVE-2024-9666" }, { "category": "external", "summary": "RedHat Customer Portal vom 2024-11-21", "url": "https://access.redhat.com/security/cve/CVE-2024-10039" }, { "category": "external", "summary": "RedHat Customer Portal vom 2024-11-21", "url": "https://access.redhat.com/security/cve/CVE-2024-10270" }, { "category": "external", "summary": "RedHat Customer Portal vom 2024-11-21", "url": "https://access.redhat.com/security/cve/CVE-2024-10451" }, { "category": "external", "summary": "RedHat Customer Portal vom 2024-11-21", "url": "https://access.redhat.com/security/cve/CVE-2024-10492" }, { "category": "external", "summary": "Keycloak Release Notes vom 2024-11-21", "url": "https://www.keycloak.org/2024/10/keycloak-2601-released" }, { "category": "external", "summary": "Keycloak Release Notes vom 2024-11-21", "url": "https://www.keycloak.org/2024/10/keycloak-2602-released" }, { "category": "external", "summary": "Keycloak Release Notes vom 2024-11-21", "url": "https://www.keycloak.org/2024/11/keycloak-2605-released" }, { "category": "external", "summary": "Keycloak Release Notes vom 2024-11-21", "url": "https://www.keycloak.org/2024/11/keycloak-2606-released" }, { "category": "external", "summary": "Red Hat Security Advisory vom 2024-11-21", "url": "https://access.redhat.com/errata/RHSA-2024:10175" }, { "category": "external", "summary": "Red Hat Security Advisory vom 2024-11-21", "url": "https://access.redhat.com/errata/RHSA-2024:10176" }, { "category": "external", "summary": "Red Hat Security Advisory vom 2024-11-21", "url": "https://access.redhat.com/errata/RHSA-2024:10177" }, { "category": "external", "summary": "Red Hat Security Advisory vom 2024-11-21", "url": "https://access.redhat.com/errata/RHSA-2024:10178" } ], "source_lang": "en-US", "title": "Keycloak: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-11-21T23:00:00.000+00:00", "generator": { "date": "2024-11-22T10:38:10.942+00:00", "engine": { "name": "BSI-WID", "version": "1.3.8" } }, "id": "WID-SEC-W-2024-3525", "initial_release_date": "2024-11-21T23:00:00.000+00:00", "revision_history": [ { "date": "2024-11-21T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c26.0.6", "product": { "name": "Open Source Keycloak \u003c26.0.6", "product_id": "T039401" } }, { "category": "product_version", "name": "26.0.6", "product": { "name": "Open Source Keycloak 26.0.6", "product_id": "T039401-fixed", "product_identification_helper": { "cpe": "cpe:/a:keycloak:keycloak:26.0.6" } } } ], "category": "product_name", "name": "Keycloak" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "Keycloak \u003c24.0.9", "product": { "name": "Red Hat OpenShift Keycloak \u003c24.0.9", "product_id": "T039402" } }, { "category": "product_version", "name": "Keycloak 24.0.9", "product": { "name": "Red Hat OpenShift Keycloak 24.0.9", "product_id": "T039402-fixed", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:keycloak___24.0.9" } } }, { "category": "product_version_range", "name": "Keycloak \u003c26.0.6", "product": { "name": "Red Hat OpenShift Keycloak \u003c26.0.6", "product_id": "T039403" } }, { "category": "product_version", "name": "Keycloak 26.0.6", "product": { "name": "Red Hat OpenShift Keycloak 26.0.6", "product_id": "T039403-fixed", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:keycloak___26.0.6" } } }, { "category": "product_version_range", "name": "Keycloak \u003c24", "product": { "name": "Red Hat OpenShift Keycloak \u003c24", "product_id": "T039404" } }, { "category": "product_version", "name": "Keycloak 24", "product": { "name": "Red Hat OpenShift Keycloak 24", "product_id": "T039404-fixed", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:keycloak___24" } } }, { "category": "product_version_range", "name": "Keycloak \u003c26.0", "product": { "name": "Red Hat OpenShift Keycloak \u003c26.0", "product_id": "T039405" } }, { "category": "product_version", "name": "Keycloak 26.0", "product": { "name": "Red Hat OpenShift Keycloak 26.0", "product_id": "T039405-fixed", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:keycloak___26.0" } } } ], "category": "product_name", "name": "OpenShift" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-10039", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Keycloak und Red Hat OpenShift aufgrund einer fehlerhaften Handhabung der zertifikatsbasierten Authentifizierung. Wenn ein Reverse-Proxy keine Pass-Through-Terminierung von TLS verwendet und mTLS aktiviert ist, kann ein lokaler Angreifer diese Schwachstelle ausnutzen, um die Authentifizierung zu umgehen und sich als jeder Benutzer oder Client zu authentifizieren, der auf mTLS vertraut." } ], "product_status": { "known_affected": [ "T039403", "T039402", "T039405", "T039404", "T039401" ] }, "release_date": "2024-11-21T23:00:00.000+00:00", "title": "CVE-2024-10039" }, { "cve": "CVE-2024-10270", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Keycloak und Red Hat OpenShift. Die Schwachstelle wird durch eine ineffiziente Komplexit\u00e4t regul\u00e4rer Ausdr\u00fccke innerhalb der SearchQueryUtils-Methode bei der Verarbeitung nicht vertrauensw\u00fcrdiger Daten verursacht, was zu einem \u00fcberm\u00e4\u00dfigen Ressourcenverbrauch f\u00fchrt. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen." } ], "product_status": { "known_affected": [ "T039403", "T039402", "T039405", "T039404", "T039401" ] }, "release_date": "2024-11-21T23:00:00.000+00:00", "title": "CVE-2024-10270" }, { "cve": "CVE-2024-10451", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Keycloak und Red Hat OpenShift. Diese Schwachstelle besteht aufgrund der unsachgem\u00e4\u00dfen Behandlung sensibler Laufzeitwerte w\u00e4hrend des Erstellungsprozesses, wodurch Passw\u00f6rter und andere sensible Daten, die als Umgebungsvariablen oder Konfigurationsoptionen angegeben wurden, als Standardwerte in den Bytecode eingebettet werden k\u00f6nnen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T039403", "T039402", "T039405", "T039404", "T039401" ] }, "release_date": "2024-11-21T23:00:00.000+00:00", "title": "CVE-2024-10451" }, { "cve": "CVE-2024-10492", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Keycloak und Red Hat OpenShift. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Validierung von Dateikontexten beim Zugriff auf Vault-Dateien. Ein entfernter, authentisierter Angreifer mit hohen Rechten kann diese Schwachstelle ausnutzen, um vertrauliche Informationen durch Manipulation der Ressourcenerstellung, wie z. B. LDAP-Anbieterkonfigurationen, offenzulegen." } ], "product_status": { "known_affected": [ "T039403", "T039402", "T039405", "T039404", "T039401" ] }, "release_date": "2024-11-21T23:00:00.000+00:00", "title": "CVE-2024-10492" }, { "cve": "CVE-2024-9666", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Keycloak und Red Hat OpenShift. Der Fehler wird durch eine inkonsistente Interpretation von HTTP-Anfragen verursacht, wodurch die Verf\u00fcgbarkeit von Diensten unterbrochen werden kann. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen." } ], "product_status": { "known_affected": [ "T039403", "T039402", "T039405", "T039404", "T039401" ] }, "release_date": "2024-11-21T23:00:00.000+00:00", "title": "CVE-2024-9666" } ] }
rhsa-2024_10177
Vulnerability from csaf_redhat
Published
2024-11-21 19:24
Modified
2024-12-06 14:55
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.0.6 Images Update
Notes
Topic
New images with security impact Important are available for Red Hat build of Keycloak 26.0.6 and Red Hat build of Keycloak 26.0.6 Operator, running on OpenShift Container Platform
Details
Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.0.6 clusters.
This erratum releases new images for Red Hat build of Keycloak 26.0.6 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.
Security fixes:
* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)
* Keycloak Denial of Service (CVE-2024-10270)
* Keycloak path trasversal (CVE-2024-10492)
* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)
* Keycloak TLS passthrough (CVE-2024-10039)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New images with security impact Important are available for Red Hat build of Keycloak 26.0.6 and Red Hat build of Keycloak 26.0.6 Operator, running on OpenShift Container Platform", "title": "Topic" }, { "category": "general", "text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.0.6 clusters.\nThis erratum releases new images for Red Hat build of Keycloak 26.0.6 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)\n* Keycloak Denial of Service (CVE-2024-10270)\n* Keycloak path trasversal (CVE-2024-10492)\n* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)\n* Keycloak TLS passthrough (CVE-2024-10039)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:10177", "url": "https://access.redhat.com/errata/RHSA-2024:10177" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10177.json" } ], "title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.0.6 Images Update", "tracking": { "current_release_date": "2024-12-06T14:55:44+00:00", "generator": { "date": "2024-12-06T14:55:44+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.2" } }, "id": "RHSA-2024:10177", "initial_release_date": "2024-11-21T19:24:23+00:00", "revision_history": [ { "date": "2024-11-21T19:24:23+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-11-21T19:24:23+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-06T14:55:44+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat build of Keycloak 26.0", "product": { "name": "Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:26.0::el9" } } } ], "category": "product_family", "name": "Red Hat build of Keycloak" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "product": { "name": "rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "product_id": "rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.0-5" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "product_id": "rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.0-6" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "product": { "name": "rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "product_id": "rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.0-5" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "product_id": "rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.0-6" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64", "product": { "name": "rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64", "product_id": "rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.0-5" } } }, { "category": "product_version", "name": "rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "product": { "name": "rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "product_id": "rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.0.6-2" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "product_id": "rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.0-6" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64 as a component of Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64" }, "product_reference": "rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "relates_to_product_reference": "9Base-RHBK-26.0" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x as a component of Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "relates_to_product_reference": "9Base-RHBK-26.0" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64 as a component of Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "relates_to_product_reference": "9Base-RHBK-26.0" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le as a component of Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "relates_to_product_reference": "9Base-RHBK-26.0" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x as a component of Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x" }, "product_reference": "rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "relates_to_product_reference": "9Base-RHBK-26.0" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le as a component of Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le" }, "product_reference": "rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "relates_to_product_reference": "9Base-RHBK-26.0" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64 as a component of Red Hat build of Keycloak 26.0", "product_id": "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" }, "product_reference": "rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64", "relates_to_product_reference": "9Base-RHBK-26.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-9666", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2024-10-08T22:25:08.077000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2317440" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.\nThe attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Server 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-9666" }, { "category": "external", "summary": "RHBZ#2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9666", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9666" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10177" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability" }, { "acknowledgments": [ { "names": [ "Alexander Schwartz" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2024-10039", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2024-10-16T15:34:51.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2319217" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-core: mTLS passthrough", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform does not ship the Keycloak server code and thus is not affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10039" }, { "category": "external", "summary": "RHBZ#2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10039", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10039" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10177" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak-core: mTLS passthrough" }, { "cve": "CVE-2024-10270", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2024-10-23T01:51:45.483000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2321214" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-services: Keycloak Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship or provide the affected component, and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10270" }, { "category": "external", "summary": "RHBZ#2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10270", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10270" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270" } ], "release_date": "2024-11-21T16:54:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10177" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-services: Keycloak Denial of Service" }, { "acknowledgments": [ { "names": [ "Steven Hawkins" ] } ], "cve": "CVE-2024-10451", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "discovery_date": "2024-10-28T07:27:41.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322096" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10451" }, { "category": "external", "summary": "RHBZ#2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10451", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10451" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451" } ], "release_date": "2024-11-21T16:55:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10177" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process" }, { "acknowledgments": [ { "names": [ "Brahim Raddahi" ], "organization": "is4u.be" } ], "cve": "CVE-2024-10492", "cwe": { "id": "CWE-73", "name": "External Control of File Name or Path" }, "discovery_date": "2024-10-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322447" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-quarkus-server: Keycloak path trasversal", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has evaluated this vulnerability. This issue only affects the keycloak-quarkus-server, which is present on the Red Hat Build of Keycloak. No other products are affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10492" }, { "category": "external", "summary": "RHBZ#2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10492", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492" } ], "release_date": "2024-11-21T16:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:23+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10177" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:df1759af072286178f29d7b70cb44cacf29698449b5aaf7284b7eaf3086ae7a7_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:89607e68cfdc0741090e4fbec8e253c60fc1fc7748504ec965bdfd71a556de68_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:9d5a5d7a2caadab9479b3c76c1a58a4706335317aa140c56f2444131aaa75fec_amd64", "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:f42eac86465f8c2cd7c9e8d5be2f5efb0d3aa78edb065c3c7df99c89c865f07c_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:6660b8b5c6628e835d01fbe7a464120d147d5b571cc5916afe800b2eb2b6d3d5_s390x", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:9f0c7ff5d4f97775801fcc17392eaba634eceb8407b0635998a406cf784591cb_ppc64le", "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:b3cf32eb519b285c4796a9ee110e323fc58beb5780fc7ddec2467da54717b216_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak-quarkus-server: Keycloak path trasversal" } ] }
rhsa-2024_10176
Vulnerability from csaf_redhat
Published
2024-11-21 19:23
Modified
2024-12-06 14:55
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 24.0.9 Update
Notes
Topic
New Red Hat build of Keycloak 24.0.9 packages with security impact Important are available from the Customer Portal
Details
Red Hat build of Keycloak 24.0.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
Security fixes:
* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)
* Keycloak Denial of Service (CVE-2024-10270)
* Keycloak path trasversal (CVE-2024-10492)
* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)
* Keycloak TLS passthrough (CVE-2024-10039)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat build of Keycloak 24.0.9 packages with security impact Important are available from the Customer Portal", "title": "Topic" }, { "category": "general", "text": "Red Hat build of Keycloak 24.0.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nSecurity fixes:\n* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)\n* Keycloak Denial of Service (CVE-2024-10270)\n* Keycloak path trasversal (CVE-2024-10492)\n* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)\n* Keycloak TLS passthrough (CVE-2024-10039)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:10176", "url": "https://access.redhat.com/errata/RHSA-2024:10176" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10176.json" } ], "title": "Red Hat Security Advisory: Red Hat build of Keycloak 24.0.9 Update", "tracking": { "current_release_date": "2024-12-06T14:55:33+00:00", "generator": { "date": "2024-12-06T14:55:33+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.2" } }, "id": "RHSA-2024:10176", "initial_release_date": "2024-11-21T19:23:47+00:00", "revision_history": [ { "date": "2024-11-21T19:23:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-11-21T19:23:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-06T14:55:33+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat build of Keycloak 24.0.9", "product": { "name": "Red Hat build of Keycloak 24.0.9", "product_id": "Red Hat build of Keycloak 24.0.9", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:24" } } } ], "category": "product_family", "name": "Red Hat build of Keycloak" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-9666", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2024-10-08T22:25:08.077000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2317440" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.\nThe attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Server 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 24.0.9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-9666" }, { "category": "external", "summary": "RHBZ#2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9666", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9666" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:47+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.", "product_ids": [ "Red Hat build of Keycloak 24.0.9" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10176" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 24.0.9" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability" }, { "acknowledgments": [ { "names": [ "Alexander Schwartz" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2024-10039", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2024-10-16T15:34:51.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2319217" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-core: mTLS passthrough", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform does not ship the Keycloak server code and thus is not affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 24.0.9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10039" }, { "category": "external", "summary": "RHBZ#2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10039", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10039" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:47+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.", "product_ids": [ "Red Hat build of Keycloak 24.0.9" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10176" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 24.0.9" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak-core: mTLS passthrough" }, { "cve": "CVE-2024-10270", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2024-10-23T01:51:45.483000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2321214" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-services: Keycloak Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship or provide the affected component, and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 24.0.9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10270" }, { "category": "external", "summary": "RHBZ#2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10270", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10270" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270" } ], "release_date": "2024-11-21T16:54:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:47+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.", "product_ids": [ "Red Hat build of Keycloak 24.0.9" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10176" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 24.0.9" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-services: Keycloak Denial of Service" }, { "acknowledgments": [ { "names": [ "Steven Hawkins" ] } ], "cve": "CVE-2024-10451", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "discovery_date": "2024-10-28T07:27:41.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322096" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 24.0.9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10451" }, { "category": "external", "summary": "RHBZ#2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10451", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10451" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451" } ], "release_date": "2024-11-21T16:55:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:47+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.", "product_ids": [ "Red Hat build of Keycloak 24.0.9" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10176" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 24.0.9" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process" }, { "acknowledgments": [ { "names": [ "Brahim Raddahi" ], "organization": "is4u.be" } ], "cve": "CVE-2024-10492", "cwe": { "id": "CWE-73", "name": "External Control of File Name or Path" }, "discovery_date": "2024-10-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322447" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-quarkus-server: Keycloak path trasversal", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has evaluated this vulnerability. This issue only affects the keycloak-quarkus-server, which is present on the Red Hat Build of Keycloak. No other products are affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 24.0.9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10492" }, { "category": "external", "summary": "RHBZ#2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10492", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492" } ], "release_date": "2024-11-21T16:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:47+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.", "product_ids": [ "Red Hat build of Keycloak 24.0.9" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10176" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "Red Hat build of Keycloak 24.0.9" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak-quarkus-server: Keycloak path trasversal" } ] }
rhsa-2024_10178
Vulnerability from csaf_redhat
Published
2024-11-21 19:24
Modified
2024-12-06 14:55
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.0.6 Update
Notes
Topic
New Red Hat build of Keycloak 26.0.6 packages with security impact Important are available from the Customer Portal
Details
Red Hat build of Keycloak 26.0.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
Security fixes:
* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)
* Keycloak Denial of Service (CVE-2024-10270)
* Keycloak path trasversal (CVE-2024-10492)
* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)
* Keycloak TLS passthrough (CVE-2024-10039)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat build of Keycloak 26.0.6 packages with security impact Important are available from the Customer Portal", "title": "Topic" }, { "category": "general", "text": "Red Hat build of Keycloak 26.0.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nSecurity fixes:\n* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)\n* Keycloak Denial of Service (CVE-2024-10270)\n* Keycloak path trasversal (CVE-2024-10492)\n* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)\n* Keycloak TLS passthrough (CVE-2024-10039)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:10178", "url": "https://access.redhat.com/errata/RHSA-2024:10178" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10178.json" } ], "title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.0.6 Update", "tracking": { "current_release_date": "2024-12-06T14:55:56+00:00", "generator": { "date": "2024-12-06T14:55:56+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.2" } }, "id": "RHSA-2024:10178", "initial_release_date": "2024-11-21T19:24:44+00:00", "revision_history": [ { "date": "2024-11-21T19:24:44+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-11-21T19:24:44+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-06T14:55:56+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat build of Keycloak 26.0.6", "product": { "name": "Red Hat build of Keycloak 26.0.6", "product_id": "Red Hat build of Keycloak 26.0.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:26" } } } ], "category": "product_family", "name": "Red Hat build of Keycloak" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-9666", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2024-10-08T22:25:08.077000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2317440" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.\nThe attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Server 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 26.0.6" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-9666" }, { "category": "external", "summary": "RHBZ#2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9666", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9666" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:44+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat build of Keycloak 26.0.6" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10178" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 26.0.6" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability" }, { "acknowledgments": [ { "names": [ "Alexander Schwartz" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2024-10039", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2024-10-16T15:34:51.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2319217" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-core: mTLS passthrough", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform does not ship the Keycloak server code and thus is not affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 26.0.6" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10039" }, { "category": "external", "summary": "RHBZ#2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10039", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10039" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:44+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat build of Keycloak 26.0.6" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10178" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 26.0.6" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak-core: mTLS passthrough" }, { "cve": "CVE-2024-10270", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2024-10-23T01:51:45.483000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2321214" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-services: Keycloak Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship or provide the affected component, and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 26.0.6" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10270" }, { "category": "external", "summary": "RHBZ#2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10270", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10270" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270" } ], "release_date": "2024-11-21T16:54:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:44+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat build of Keycloak 26.0.6" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10178" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 26.0.6" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-services: Keycloak Denial of Service" }, { "acknowledgments": [ { "names": [ "Steven Hawkins" ] } ], "cve": "CVE-2024-10451", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "discovery_date": "2024-10-28T07:27:41.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322096" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 26.0.6" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10451" }, { "category": "external", "summary": "RHBZ#2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10451", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10451" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451" } ], "release_date": "2024-11-21T16:55:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:44+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat build of Keycloak 26.0.6" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10178" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat build of Keycloak 26.0.6" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process" }, { "acknowledgments": [ { "names": [ "Brahim Raddahi" ], "organization": "is4u.be" } ], "cve": "CVE-2024-10492", "cwe": { "id": "CWE-73", "name": "External Control of File Name or Path" }, "discovery_date": "2024-10-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322447" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-quarkus-server: Keycloak path trasversal", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has evaluated this vulnerability. This issue only affects the keycloak-quarkus-server, which is present on the Red Hat Build of Keycloak. No other products are affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat build of Keycloak 26.0.6" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10492" }, { "category": "external", "summary": "RHBZ#2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10492", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492" } ], "release_date": "2024-11-21T16:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:24:44+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat build of Keycloak 26.0.6" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10178" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "Red Hat build of Keycloak 26.0.6" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak-quarkus-server: Keycloak path trasversal" } ] }
rhsa-2024_10175
Vulnerability from csaf_redhat
Published
2024-11-21 19:23
Modified
2024-12-06 14:55
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 24.0.9 Images Update
Notes
Topic
New images with security impact Important are available for Red Hat build of Keycloak 24.0.9 and Red Hat build of Keycloak 24.0.9 Operator, running on OpenShift Container Platform.
Details
Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 24.0.9 clusters.
This erratum releases new images for Red Hat build of Keycloak 24.0.9 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.
Security fixes:
* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)
* Keycloak Denial of Service (CVE-2024-10270)
* Keycloak path trasversal (CVE-2024-10492)
* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)
* Keycloak TLS passthrough (CVE-2024-10039)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New images with security impact Important are available for Red Hat build of Keycloak 24.0.9 and Red Hat build of Keycloak 24.0.9 Operator, running on OpenShift Container Platform.", "title": "Topic" }, { "category": "general", "text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 24.0.9 clusters.\nThis erratum releases new images for Red Hat build of Keycloak 24.0.9 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)\n* Keycloak Denial of Service (CVE-2024-10270)\n* Keycloak path trasversal (CVE-2024-10492)\n* Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)\n* Keycloak TLS passthrough (CVE-2024-10039)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:10175", "url": "https://access.redhat.com/errata/RHSA-2024:10175" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10175.json" } ], "title": "Red Hat Security Advisory: Red Hat build of Keycloak 24.0.9 Images Update", "tracking": { "current_release_date": "2024-12-06T14:55:22+00:00", "generator": { "date": "2024-12-06T14:55:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.2" } }, "id": "RHSA-2024:10175", "initial_release_date": "2024-11-21T19:23:20+00:00", "revision_history": [ { "date": "2024-11-21T19:23:20+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-11-21T19:23:20+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-06T14:55:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat build of Keycloak 24", "product": { "name": "Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:24::el9" } } } ], "category": "product_family", "name": "Red Hat build of Keycloak" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "product": { "name": "rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "product_id": "rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-18" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "product_id": "rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-18" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "product": { "name": "rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "product_id": "rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-18" } } }, { "category": "product_version", "name": "rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "product": { "name": "rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "product_id": "rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=24.0.9-1" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "product_id": "rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-18" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x", "product": { "name": "rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x", "product_id": "rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-18" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "product_id": "rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-18" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64 as a component of Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64" }, "product_reference": "rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "relates_to_product_reference": "9Base-RHBK-24" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64 as a component of Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "relates_to_product_reference": "9Base-RHBK-24" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le as a component of Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "relates_to_product_reference": "9Base-RHBK-24" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x as a component of Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "relates_to_product_reference": "9Base-RHBK-24" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le as a component of Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le" }, "product_reference": "rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "relates_to_product_reference": "9Base-RHBK-24" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64 as a component of Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64" }, "product_reference": "rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "relates_to_product_reference": "9Base-RHBK-24" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x as a component of Red Hat build of Keycloak 24", "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" }, "product_reference": "rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x", "relates_to_product_reference": "9Base-RHBK-24" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-9666", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2024-10-08T22:25:08.077000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2317440" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service.\nThe attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Server 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-9666" }, { "category": "external", "summary": "RHBZ#2317440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317440" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9666", "url": "https://www.cve.org/CVERecord?id=CVE-2024-9666" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9666" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:20+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10175" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability" }, { "acknowledgments": [ { "names": [ "Alexander Schwartz" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2024-10039", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2024-10-16T15:34:51.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2319217" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-core: mTLS passthrough", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform does not ship the Keycloak server code and thus is not affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10039" }, { "category": "external", "summary": "RHBZ#2319217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319217" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10039", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10039" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10039" } ], "release_date": "2024-11-21T16:45:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:20+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10175" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak-core: mTLS passthrough" }, { "cve": "CVE-2024-10270", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2024-10-23T01:51:45.483000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2321214" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-services: Keycloak Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship or provide the affected component, and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10270" }, { "category": "external", "summary": "RHBZ#2321214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321214" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10270", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10270" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10270" } ], "release_date": "2024-11-21T16:54:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:20+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10175" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-services: Keycloak Denial of Service" }, { "acknowledgments": [ { "names": [ "Steven Hawkins" ] } ], "cve": "CVE-2024-10451", "cwe": { "id": "CWE-798", "name": "Use of Hard-coded Credentials" }, "discovery_date": "2024-10-28T07:27:41.800000+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322096" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Application Platform 8 does not ship the affected component and so is not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10451" }, { "category": "external", "summary": "RHBZ#2322096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10451", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10451" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451" } ], "release_date": "2024-11-21T16:55:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:20+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10175" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process" }, { "acknowledgments": [ { "names": [ "Brahim Raddahi" ], "organization": "is4u.be" } ], "cve": "CVE-2024-10492", "cwe": { "id": "CWE-73", "name": "External Control of File Name or Path" }, "discovery_date": "2024-10-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2322447" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak-quarkus-server: Keycloak path trasversal", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has evaluated this vulnerability. This issue only affects the keycloak-quarkus-server, which is present on the Red Hat Build of Keycloak. No other products are affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-10492" }, { "category": "external", "summary": "RHBZ#2322447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322447" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-10492", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10492" } ], "release_date": "2024-11-21T16:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-11-21T19:23:20+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:10175" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:b88294b9033853bf4874fe5f14757c217c7ab3901dfd6ded46b880fd9bd9543b_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:3c74dc71609ff709e4221145dbca43ea1fd973789d3b380a00402e7700d10b68_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:446294f7b35b9e1a3ad908ceab53fabbd1b8dfa0535e6b9a7acebcd038a2507a_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b0259432bac5499e7ea08136ef8357851d1f5be64a3b5086cdf46bfaac9d50b0_s390x", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:0d281d30fa7f931cabd50b24c908c2b61c1fc527326626ad4fff548e47bfd577_ppc64le", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:69f6df6ec90aca5d801c6724e5350700548d8903a4be3aef7a1bb95bbbbdb0c6_amd64", "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:801d2ade5b61cadf0508f347881ae496e679725a6052653619044a63938b8184_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak-quarkus-server: Keycloak path trasversal" } ] }
ghsa-v7gv-xpgf-6395
Vulnerability from github
Published
2024-11-25 18:41
Modified
2024-11-25 18:41
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
Keycloak Build Process Exposes Sensitive Data
Details
A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.keycloak:keycloak-quarkus-server" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "24.0.9" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.keycloak:keycloak-quarkus-server" }, "ranges": [ { "events": [ { "introduced": "25.0.0" }, { "fixed": "26.0.6" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2024-10451" ], "database_specific": { "cwe_ids": [ "CWE-798" ], "github_reviewed": true, "github_reviewed_at": "2024-11-25T18:41:17Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.", "id": "GHSA-v7gv-xpgf-6395", "modified": "2024-11-25T18:41:17Z", "published": "2024-11-25T18:41:17Z", "references": [ { "type": "WEB", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v7gv-xpgf-6395" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10451" }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/198214310eb45b86707f823ccb5a2d65c814b528" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:10175" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:10176" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:10177" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:10178" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-10451" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322096" }, { "type": "PACKAGE", "url": "https://github.com/keycloak/keycloak" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Keycloak Build Process Exposes Sensitive Data" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.