RHSA-2024:6501 - Security Advisory

Topic

New Red Hat build of Keycloak 22.0.12 packages are available from the Customer Portal. This is a security update with Moderate impact rating.

Description

Red Hat build of Keycloak 22.0.12 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat build of Keycloak 22.0.12 serves as a replacement for Red Hat Single Sign-On 7.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security fixes:

• potential bypass of brute force protection (CVE-2024-4629)
• session fixation in elytron saml adapters (CVE-2024-7341)
• Leak of configured LDAP bind credentials through the Keycloak admin console (CVE-2024-5967)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Affected Products

• Red Hat build of Keycloak Text-only Advisories x86_64

Fixes

• BZ - 2276761 - CVE-2024-4629 keycloak: potential bypass of brute force protection
• BZ - 2292200 - CVE-2024-5967 keycloak: Leak of configured LDAP bind credentials through the Keycloak admin console
• BZ - 2302064 - CVE-2024-7341 wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

CVEs

• CVE-2024-4629
• CVE-2024-5967
• CVE-2024-7341

References

• https://access.redhat.com/security/updates/classification/#moderate