(RHSA-2024:6888) Important: Red Hat build of Keycloak 22.0.13 Update

2024-09-1917:01:24

access.redhat.com

red hat

keycloak

authentication

single sign-on

bug fixes

enhancements

release notes

saml responses

privilege escalation

cve-2024-8698

redirect uri validation

open redirec

cve-2024-8883

security

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

AI Score

7.8

Confidence

High

EPSS

0.005

Percentile

76.5%

JSON

Red Hat build of Keycloak 22.0.13 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat build of Keycloak 22.0.13 serves as a replacement for Red Hat Single Sign-On 7.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security fixes:

Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak (CVE-2024-8698)
Vulnerable Redirect URI Validation Results in Open Redirec (CVE-2024-8883)