{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New Red Hat build of Keycloak 24.0.7 packages are available from the Customer Portal",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak 24.0.7 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nSecurity fixes:\n* session fixation in elytron saml adapters (CVE-2024-7341)\n* One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318)\n* Open Redirect on Account page (CVE-2024-7260)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:6503",
        "url": "https://access.redhat.com/errata/RHSA-2024:6503"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2301875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
      },
      {
        "category": "external",
        "summary": "2301876",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
      },
      {
        "category": "external",
        "summary": "2302064",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6503.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Update",
    "tracking": {
      "current_release_date": "2024-11-24T18:42:55+00:00",
      "generator": {
        "date": "2024-11-24T18:42:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:6503",
      "initial_release_date": "2024-09-09T16:05:49+00:00",
      "revision_history": [
        {
          "date": "2024-09-09T16:05:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-09T16:05:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T18:42:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of Keycloak",
                "product": {
                  "name": "Red Hat Build of Keycloak",
                  "product_id": "Red Hat Build of Keycloak",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:24"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7260",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2024-07-31T02:53:42+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.\r\n\r\nOnce a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: Open Redirect on Account page",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7260",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:49+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-core: Open Redirect on Account page"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7318",
      "cwe": {
        "id": "CWE-324",
        "name": "Use of a Key Past its Expiration Date"
      },
      "discovery_date": "2024-07-31T03:04:38+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301876"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.\r\nA one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This finding was marked Moderate because it is a 2x increase, which is not too long.\n\nRed Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301876",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:49+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity"
    },
    {
      "cve": "CVE-2024-7341",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2024-07-31T15:02:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2302064"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. While it presents a session fixation risk, the attacker must first hijack a session before authentication. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the `turnOffChangeSessionIdOnLogin` option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "RHBZ#2302064",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341"
        }
      ],
      "release_date": "2024-09-09T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:49+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New images are available for Red Hat build of Keycloak 24.0.7 and Red Hat build of Keycloak 24.0.7 Operator, running on OpenShift Container Platform. https://errata.devel.redhat.com/advisory/138173",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 24.0.7 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak 24.0.7 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* session fixation in elytron saml adapters (CVE-2024-7341)\n* One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318)\n* Open Redirect on Account page (CVE-2024-7260)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:6502",
        "url": "https://access.redhat.com/errata/RHSA-2024:6502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2301875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
      },
      {
        "category": "external",
        "summary": "2301876",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
      },
      {
        "category": "external",
        "summary": "2302064",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6502.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Images Update",
    "tracking": {
      "current_release_date": "2024-11-24T18:42:45+00:00",
      "generator": {
        "date": "2024-11-24T18:42:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:6502",
      "initial_release_date": "2024-09-09T16:05:24+00:00",
      "revision_history": [
        {
          "date": "2024-09-09T16:05:24+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-09T16:05:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T18:42:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 24",
                "product": {
                  "name": "Red Hat build of Keycloak 24",
                  "product_id": "9Base-RHBK-24",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:24::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-16"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-16"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=24.0.7-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-16"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64 as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64 as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64 as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
        "relates_to_product_reference": "9Base-RHBK-24"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7260",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2024-07-31T02:53:42+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.\r\n\r\nOnce a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: Open Redirect on Account page",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7260",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:24+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6502"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-core: Open Redirect on Account page"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7318",
      "cwe": {
        "id": "CWE-324",
        "name": "Use of a Key Past its Expiration Date"
      },
      "discovery_date": "2024-07-31T03:04:38+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301876"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.\r\nA one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This finding was marked Moderate because it is a 2x increase, which is not too long.\n\nRed Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301876",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:24+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6502"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity"
    },
    {
      "cve": "CVE-2024-7341",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2024-07-31T15:02:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2302064"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. While it presents a session fixation risk, the attacker must first hijack a session before authentication. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the `turnOffChangeSessionIdOnLogin` option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "RHBZ#2302064",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341"
        }
      ],
      "release_date": "2024-09-09T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:24+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-7318"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-324"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-09T22:34:10Z",
    "nvd_published_at": "2024-09-09T19:15:14Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.\nA one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.",
  "id": "GHSA-57rh-gr4v-j5f6",
  "modified": "2024-09-09T22:34:10Z",
  "published": "2024-09-09T21:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:6502"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:6503"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-7318"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Keycloak Uses a Key Past its Expiration Date"
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um falsche Informationen darzustellen um die Authentifizierung zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-2083 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2083.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-2083 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2083"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2024-09-09",
        "url": "https://access.redhat.com/errata/RHSA-2024:6502"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2024-09-09",
        "url": "https://access.redhat.com/errata/RHSA-2024:6503"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat OpenShift Keycloak: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-09-09T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-10T09:33:46.587+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-2083",
      "initial_release_date": "2024-09-09T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-09-09T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cKeycloak 24.0.7",
                "product": {
                  "name": "Red Hat OpenShift \u003cKeycloak 24.0.7",
                  "product_id": "T037364"
                }
              },
              {
                "category": "product_version",
                "name": "Keycloak 24.0.7",
                "product": {
                  "name": "Red Hat OpenShift Keycloak 24.0.7",
                  "product_id": "T037364-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:keycloak_24.0.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-7260",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Red Hat OpenShift. Dieser Fehler, der Keycloak betrifft, ist auf eine unsachgem\u00e4\u00dfe Validierung der referrer- und referrer_uri-Parameter zur\u00fcckzuf\u00fchren. Dadurch kann eine b\u00f6sartige URL erstellt werden, die scheinbar von einer vertrauensw\u00fcrdigen Quelle stammt, den Benutzer aber auf eine b\u00f6sartige Website umleitet. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um einen Phishing-Angriff durchzuf\u00fchren und weitere dom\u00e4nenbezogene Security Checks zu umgehen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037364"
        ]
      },
      "release_date": "2024-09-09T22:00:00.000+00:00",
      "title": "CVE-2024-7260"
    },
    {
      "cve": "CVE-2024-7318",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Red Hat OpenShift. Diese Fehler, der Keycloak betrifft, ist auf die unsachgem\u00e4\u00dfe Behandlung von One-Time-Password-Codes zur\u00fcckzuf\u00fchren, was zu einem erh\u00f6hten Risiko des Missbrauchs durch b\u00f6swillige Akteure und einer m\u00f6glichen Kompromittierung des Kontos f\u00fchrt. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um die Authentifizierung zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037364"
        ]
      },
      "release_date": "2024-09-09T22:00:00.000+00:00",
      "title": "CVE-2024-7318"
    },
    {
      "cve": "CVE-2024-7341",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Red Hat OpenShift. Diese Schwachstelle in Keycloak ist auf ein Session Fixation Problem in den SAML Adaptern zur\u00fcckzuf\u00fchren, welches dazu f\u00fchrt, dass die Session vor der Authentifizierung \u00fcbernommen und die Kontrolle \u00fcber die Session erlangt wird. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um die Authentifizierung zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037364"
        ]
      },
      "release_date": "2024-09-09T22:00:00.000+00:00",
      "title": "CVE-2024-7341"
    }
  ]
}