红帽产品勘误 RHSA-2025:0300 - Security Advisory
发布：
2025-01-13
已更新：
2025-01-13

RHSA-2025:0300 - Security Advisory

概述

Moderate: Red Hat build of Keycloak 26.0.8 Update

类型/严重性

Security Advisory: Moderate

标题

New Red Hat build of Keycloak 26.0.8 packages are available from the Customer Portal

描述

Red Hat build of Keycloak 26.0.8 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:

  • Denial of Service in Keycloak Server via Security Headers (CVE-2024-11734)
  • Unrestricted admin use of system and environment variables (CVE-2024-11736)

解决方案

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Red Hat build of Keycloak Text-only Advisories x86_64

修复

  • BZ - 2328846 - CVE-2024-11734 org.keycloak:keycloak-quarkus-server: Denial of Service in Keycloak Server via Security Headers
  • BZ - 2328850 - CVE-2024-11736 org.keycloak:keycloak-quarkus-server: Unrestricted admin use of system and environment variables

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。