Red Hat Product Errata RHSA-2024:10176 - Security Advisory
Issued:
2024-11-21
Updated:
2024-11-21

RHSA-2024:10176 - Security Advisory

Synopsis

Important: Red Hat build of Keycloak 24.0.9 Update

Type/Severity

Security Advisory: Important

Topic

New Red Hat build of Keycloak 24.0.9 packages with security impact Important are available from the Customer Portal

Description

Red Hat build of Keycloak 24.0.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:

  • Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)
  • Keycloak Denial of Service (CVE-2024-10270)
  • Keycloak path trasversal (CVE-2024-10492)
  • Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)
  • Keycloak TLS passthrough (CVE-2024-10039)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Affected Products

  • Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

  • BZ - 2317440 - CVE-2024-9666 org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability
  • BZ - 2319217 - CVE-2024-10039 keycloak-core: mTLS passthrough
  • BZ - 2321214 - CVE-2024-10270 org.keycloak:keycloak-services: Keycloak Denial of Service
  • BZ - 2322096 - CVE-2024-10451 org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process
  • BZ - 2322447 - CVE-2024-10492 keycloak-quarkus-server: Keycloak path trasversal

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.