rhsa-2024_6500
Vulnerability from csaf_redhat
Published
2024-09-09 16:05
Modified
2024-11-24 18:42
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 22.0.12 Images Update

Notes

Topic
New images are available for Red Hat build of Keycloak 22.0.12 and Red Hat build of Keycloak 22.0.12 Operator, running on OpenShift Container Platform. This is a security update with Moderate impact rating.
Details
Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 22.0.12 clusters. This erratum releases new images for Red Hat build of Keycloak 22.0.12 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * potential bypass of brute force protection (CVE-2024-4629) * session fixation in elytron saml adapters (CVE-2024-7341) * Leak of configured LDAP bind credentials through the Keycloak admin console (CVE-2024-5967)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New images are available for Red Hat build of Keycloak 22.0.12 and Red Hat build of Keycloak 22.0.12 Operator, running on OpenShift Container Platform. This is a security update with Moderate impact rating.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 22.0.12 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak 22.0.12 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* potential bypass of brute force protection (CVE-2024-4629)\n* session fixation in elytron saml adapters (CVE-2024-7341)\n* Leak of configured LDAP bind credentials through the Keycloak admin console (CVE-2024-5967)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:6500",
        "url": "https://access.redhat.com/errata/RHSA-2024:6500"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2276761",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2276761"
      },
      {
        "category": "external",
        "summary": "2292200",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292200"
      },
      {
        "category": "external",
        "summary": "2302064",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6500.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 22.0.12 Images Update",
    "tracking": {
      "current_release_date": "2024-11-24T18:42:34+00:00",
      "generator": {
        "date": "2024-11-24T18:42:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:6500",
      "initial_release_date": "2024-09-09T16:05:51+00:00",
      "revision_history": [
        {
          "date": "2024-09-09T16:05:51+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-09T16:05:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T18:42:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 22",
                "product": {
                  "name": "Red Hat build of Keycloak 22",
                  "product_id": "9Base-RHBK-22",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:22::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=22-17"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=22.0.12-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=22-20"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=22-17"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=22-20"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=22-17"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=22-20"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64 as a component of Red Hat build of Keycloak 22",
          "product_id": "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
        "relates_to_product_reference": "9Base-RHBK-22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x as a component of Red Hat build of Keycloak 22",
          "product_id": "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
        "relates_to_product_reference": "9Base-RHBK-22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64 as a component of Red Hat build of Keycloak 22",
          "product_id": "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
        "relates_to_product_reference": "9Base-RHBK-22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le as a component of Red Hat build of Keycloak 22",
          "product_id": "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le as a component of Red Hat build of Keycloak 22",
          "product_id": "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64 as a component of Red Hat build of Keycloak 22",
          "product_id": "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
        "relates_to_product_reference": "9Base-RHBK-22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x as a component of Red Hat build of Keycloak 22",
          "product_id": "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x",
        "relates_to_product_reference": "9Base-RHBK-22"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-4629",
      "cwe": {
        "id": "CWE-837",
        "name": "Improper Enforcement of a Single, Unique Action"
      },
      "discovery_date": "2024-04-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2276761"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak: potential bypass of brute force protection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is classified as low severity due to its potential impact on account security in Keycloak environments. By exploiting the timing between login attempts and the application of brute force protection, attackers can circumvent lockout mechanisms intended to prevent multiple failed authentication attempts. This allows attackers to increase the number of guesses they can make within the authentication system, potentially leading to unauthorized access to user accounts.\n\nRed Hat has evaluated this vulnerability and it only affects the Red Hat Single Sign-On (RHSSO) and Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-4629"
        },
        {
          "category": "external",
          "summary": "RHBZ#2276761",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2276761"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-4629",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-4629"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-4629",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4629"
        }
      ],
      "release_date": "2024-09-03T19:38:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:51+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak: potential bypass of brute force protection"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Simon Wessling"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2024-5967",
      "cwe": {
        "id": "CWE-276",
        "name": "Incorrect Default Permissions"
      },
      "discovery_date": "2024-06-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2292200"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL\u00a0 independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin\u00a0access (permission manage-realm) to change the LDAP host URL (\"Connection URL\") to a machine they control. The Keycloak server will connect to the attacker\u0027s host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak: Leak of configured LDAP bind credentials through the Keycloak admin console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-5967"
        },
        {
          "category": "external",
          "summary": "RHBZ#2292200",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292200"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-5967",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-5967"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-5967",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5967"
        }
      ],
      "release_date": "2024-06-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:51+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak: Leak of configured LDAP bind credentials through the Keycloak admin console"
    },
    {
      "cve": "CVE-2024-7341",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2024-07-31T15:02:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2302064"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. While it presents a session fixation risk, the attacker must first hijack a session before authentication. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the `turnOffChangeSessionIdOnLogin` option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
          "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "RHBZ#2302064",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341"
        }
      ],
      "release_date": "2024-09-09T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:51+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-22:rhbk/keycloak-operator-bundle@sha256:43fc6282df4d91c68a9618f9bf2a4159690e69c207b8ba60e907dd64847fdc53_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:29626722accc2d089262f4ef101819a46b4ea608e1865fd59ea5ac3b3661e9ec_s390x",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:73e1d687a59f2adff13c64109c9f7da91e340c73eae673905360bf86925820e8_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9-operator@sha256:a5bdad714236fe8b179215915b1cb466fe5b0c3d5da1cfe0debd8c963084f4bb_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:4997cbb3b782b64e7b4c14d2cd0ac6cc98aa8d76bd538ccf46f48493fcf30837_ppc64le",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:6fd26b6c895ab17f670e119376a956400fe35b2b3ea99a07a5fa4dd08cb8eb95_amd64",
            "9Base-RHBK-22:rhbk/keycloak-rhel9@sha256:cdfa1a0a652fbbb8291afe1db95bc30bd39a2f2e5fbc085825b56c51bdc78748_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.