Protect yourself against future threats.
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2024.2387
Red Hat Single Sign-On 7.6.8 enhancement and security update on RHEL 7
18 April 2024
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat Single Sign-On 7.6
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2024-1635 CVE-2023-6484 CVE-2023-6544
CVE-2024-1132 CVE-2024-1249
Original Bulletin:
https://access.redhat.com/errata/RHSA-2024:1860
Comment: CVSS (Max): 8.1 CVE-2024-1132 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Single Sign-On 7.6.8
enhancement and security update on RHEL 7
Advisory ID: RHSA-2024:1860
Product: Red Hat Single Sign-On 7.6 for RHEL 7 Server
Advisory URL: https://access.redhat.com/errata/RHSA-2024:1860
Issue date: 2024-04-16
CVE Names: CVE-2023-6484 CVE-2023-6544 CVE-2024-1132 CVE-2024-1249
CVE-2024-1635
=====================================================================
1. Summary:
New Red Hat Single Sign-On 7.6.8 deliverables are now available for Red Hat
Enterprise Linux 7.
This is an enhancement and security update with Important impact rating and
package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Single Sign-On 7.6 for RHEL 7 Server - noarch
3. Description:
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.8 on RHEL 7 serves as a replacement
for Red Hat Single Sign-On 7.6.7, and includes bug fixes, security updates and
enhancements which are linked to in the References.
Security Fix(es):
* Authorization Bypass (CVE-2023-6544)
* Log Injection during WebAuthn authentication or registration (CVE-2023-6484)
* path transversal in redirection validation (CVE-2024-1132)
* unvalidated cross-origin messages in checkLoginIframe leads to DDoS
(CVE-2024-1249)
* undertow: Out-of-memory Error after several closed connections with wildfly-
http-client protocol (CVE-2024-1635)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in the
References section.
4. Solution:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
2248423 - CVE-2023-6484 - keycloak: Log Injection during WebAuthn authentication
or registration
2253116 - CVE-2023-6544 - keycloak: Authorization Bypass
2262117 - CVE-2024-1132 - keycloak: path transversal in redirection validation
2262918 - CVE-2024-1249 - keycloak: org.keycloak.protocol.oidc: unvalidated
cross-origin messages in checkLoginIframe leads to DDoS
2264928 - CVE-2024-1635 - undertow: Out-of-memory Error after several closed
connections with wildfly-http-client protocol
6. Package List:
Red Hat Single Sign-On 7.6 for RHEL 7 Server
noarch:
rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el7sso.noarch.rpm
rh-sso7-keycloak-server-0:18.0.13-1.redhat_00001.1.el7sso.noarch.rpm
Source:
rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el7sso.src.rpm
7. References:
https://access.redhat.com/security/cve/CVE-2023-6484
https://access.redhat.com/security/cve/CVE-2023-6544
https://access.redhat.com/security/cve/CVE-2024-1132
https://access.redhat.com/security/cve/CVE-2024-1249
https://access.redhat.com/security/cve/CVE-2024-1635
https://access.redhat.com/security/updates/classification/#important
- --------------------------END INCLUDED TEXT----------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================