Protect yourself against future threats.
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2024.2390
Red Hat Single Sign-On 7.6.8 for OpenShift image enhancement and security
update
18 April 2024
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat Single Sign-On
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2024-1635 CVE-2023-6484 CVE-2023-6544
CVE-2024-1132 CVE-2024-1249
Original Bulletin:
https://access.redhat.com/errata/RHSA-2024:1864
Comment: CVSS (Max): 8.1 CVE-2024-1132 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Single Sign-On 7.6.8 for
OpenShift image enhancement and security update
Advisory ID: RHSA-2024:1864
Product: Middleware Containers for OpenShift
Advisory URL: https://access.redhat.com/errata/RHSA-2024:1864
Issue date: 2024-04-16
CVE Names: CVE-2023-6484 CVE-2023-6544 CVE-2024-1132 CVE-2024-1249
CVE-2024-1635
=====================================================================
1. Summary:
A new image is available for Red Hat Single Sign-On 7.6.8, running on OpenShift
Container Platform 3.10 and 3.11, and 4.3.
This is an enhancement and security update with Important impact rating and
package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Middleware Containers for OpenShift - amd64, ppc64le, s390x
3. Description:
Red Hat Single Sign-On is an integrated sign-on solution, available as a
Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat
Single Sign-On for OpenShift image provides an authentication server that
you can use to log in centrally, log out, and register. You can also manage
user accounts for web applications, mobile applications, and RESTful web
services.
Security Fix(es):
* Authorization Bypass (CVE-2023-6544)
* Log Injection during WebAuthn authentication or registration (CVE-2023-6484)
* path transversal in redirection validation (CVE-2024-1132)
* unvalidated cross-origin messages in checkLoginIframe leads to DDoS
(CVE-2024-1249)
* undertow: Out-of-memory Error after several closed connections with wildfly-
http-client protocol (CVE-2024-1635)
This erratum releases a new image for Red Hat Single Sign-On 7.6.8 for
use within the OpenShift Container Platform 3.10, OpenShift Container Platform
3.11, and within the OpenShift Container Platform 4.3 cloud computing Platform-
as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with
the standalone product release.
4. Solution:
To update to the latest Red Hat Single Sign-On 7.6.8 for OpenShift
image, Follow these steps to pull in the content:
1. On your main hosts, ensure you are logged into the CLI as a
cluster administrator or user with project administrator access
to the global "openshift" project. For example:
$ oc login -u system:admin
2. Update the core set of Red Hat Single Sign-On resources for OpenShift
in the "openshift" project by running the following commands:
$ for resource in sso76-image-stream.json \
sso76-https.json \
sso76-mysql.json \
sso76-mysql-persistent.json \
sso76-postgresql.json \
sso76-postgresql-persistent.json \
sso76-x509-https.json \
sso76-x509-mysql-persistent.json \
sso76-x509-postgresql-persistent.json
do
oc replace -n openshift --force -f \
https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-
image/v7.6.8.GA/templates/${resource}
done
3. Install the Red Hat Single Sign-On 7.6.8 for OpenShift streams in the
"openshift" project by running the following commands:
$ oc -n openshift import-image redhat-sso76-openshift:1.0
5. Bugs fixed (https://bugzilla.redhat.com/):
2248423 - CVE-2023-6484 - keycloak: Log Injection during WebAuthn authentication
or registration
2253116 - CVE-2023-6544 - keycloak: Authorization Bypass
2262117 - CVE-2024-1132 - keycloak: path transversal in redirection validation
2262918 - CVE-2024-1249 - keycloak: org.keycloak.protocol.oidc: unvalidated
cross-origin messages in checkLoginIframe leads to DDoS
2264928 - CVE-2024-1635 - undertow: Out-of-memory Error after several closed
connections with wildfly-http-client protocol
6. Package List:
Middleware Containers for OpenShift
8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:1909db8bc47fdb4f651
2e08fb21ec1457f64fa0abf8edf2530f5bf5a494d9b6d_amd64:
rh-sso-7/sso76-openshift-rhel8@sha256:1909db8bc47fdb4f6512e08fb21ec1457f64fa0abf
8edf2530f5bf5a494d9b6d_amd64.rpm
8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:1f842e8f262ece6cd98
941fd29562251e19479eb4f4ba7cbd8e9a3bfa79325f0_s390x:
rh-sso-7/sso76-openshift-rhel8@sha256:1f842e8f262ece6cd98941fd29562251e19479eb4f
4ba7cbd8e9a3bfa79325f0_s390x.rpm
8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:b666f093f22ef278111
14cca95c20aed890d4f3342116ab990d084cb2627d8cf_ppc64le:
rh-sso-7/sso76-openshift-rhel8@sha256:b666f093f22ef27811114cca95c20aed890d4f3342
116ab990d084cb2627d8cf_ppc64le.rpm
7. References:
https://access.redhat.com/security/cve/CVE-2023-6484
https://access.redhat.com/security/cve/CVE-2023-6544
https://access.redhat.com/security/cve/CVE-2024-1132
https://access.redhat.com/security/cve/CVE-2024-1249
https://access.redhat.com/security/cve/CVE-2024-1635
https://access.redhat.com/security/updates/classification/#important
- --------------------------END INCLUDED TEXT----------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================