rhsa-2024_6502
Vulnerability from csaf_redhat
Published
2024-09-09 16:05
Modified
2024-11-24 18:42
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Images Update

Notes

Topic
New images are available for Red Hat build of Keycloak 24.0.7 and Red Hat build of Keycloak 24.0.7 Operator, running on OpenShift Container Platform. https://errata.devel.redhat.com/advisory/138173
Details
Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 24.0.7 clusters. This erratum releases new images for Red Hat build of Keycloak 24.0.7 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * session fixation in elytron saml adapters (CVE-2024-7341) * One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318) * Open Redirect on Account page (CVE-2024-7260)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New images are available for Red Hat build of Keycloak 24.0.7 and Red Hat build of Keycloak 24.0.7 Operator, running on OpenShift Container Platform. https://errata.devel.redhat.com/advisory/138173",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 24.0.7 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak 24.0.7 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* session fixation in elytron saml adapters (CVE-2024-7341)\n* One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318)\n* Open Redirect on Account page (CVE-2024-7260)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:6502",
        "url": "https://access.redhat.com/errata/RHSA-2024:6502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2301875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
      },
      {
        "category": "external",
        "summary": "2301876",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
      },
      {
        "category": "external",
        "summary": "2302064",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6502.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Images Update",
    "tracking": {
      "current_release_date": "2024-11-24T18:42:45+00:00",
      "generator": {
        "date": "2024-11-24T18:42:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2024:6502",
      "initial_release_date": "2024-09-09T16:05:24+00:00",
      "revision_history": [
        {
          "date": "2024-09-09T16:05:24+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-09T16:05:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-24T18:42:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 24",
                "product": {
                  "name": "Red Hat build of Keycloak 24",
                  "product_id": "9Base-RHBK-24",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:24::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-16"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-16"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=24-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=24.0.7-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=24-16"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64 as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64 as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64 as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-24"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x as a component of Red Hat build of Keycloak 24",
          "product_id": "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x",
        "relates_to_product_reference": "9Base-RHBK-24"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7260",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2024-07-31T02:53:42+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.\r\n\r\nOnce a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: Open Redirect on Account page",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7260",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:24+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6502"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-core: Open Redirect on Account page"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7318",
      "cwe": {
        "id": "CWE-324",
        "name": "Use of a Key Past its Expiration Date"
      },
      "discovery_date": "2024-07-31T03:04:38+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301876"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.\r\nA one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This finding was marked Moderate because it is a 2x increase, which is not too long.\n\nRed Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301876",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:24+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6502"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity"
    },
    {
      "cve": "CVE-2024-7341",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2024-07-31T15:02:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2302064"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. While it presents a session fixation risk, the attacker must first hijack a session before authentication. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the `turnOffChangeSessionIdOnLogin` option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
          "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "RHBZ#2302064",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341"
        }
      ],
      "release_date": "2024-09-09T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:24+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-24:rhbk/keycloak-operator-bundle@sha256:c8d17b07c4e84a514529674d019668e003f85a672f30213ba9320aa81f64d010_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:0b6f71aa1735670a881e0c9fd6c95851f077fb204e004beffc8481d7220ae095_s390x",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:201b5716a28a2d31338a75e844259f278612354010c6c3ac1ccfb60bd194df29_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9-operator@sha256:b46a8d3105bf1e3a31ca707b032223b38cf3381a57f7f44a150f399b68115346_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:00a713fd08f68df2e3b06c9131eb732febb70e795e0345e7a5df1d1fb8ac45b4_amd64",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:71ca272bd39f0b082758f0c82df1302d9b51a5b445010944f734242bbe2eefb6_ppc64le",
            "9Base-RHBK-24:rhbk/keycloak-rhel9@sha256:991795cc7cdb6a2ccc55c935a34291a01a9784be306ec980eb3904d64466629e_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.