Protect yourself against future threats.
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2024.2391
Red Hat Single Sign-On 7.6.8 security update
18 April 2024
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat Single Sign-On
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2024-1635 CVE-2023-6484 CVE-2023-6544
CVE-2024-1132 CVE-2024-1249
Original Bulletin:
https://access.redhat.com/errata/RHSA-2024:1866
Comment: CVSS (Max): 8.1 CVE-2024-1132 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Single Sign-On 7.6.8 security
update
Advisory ID: RHSA-2024:1866
Product: RHSSO 7.6.8
Advisory URL: https://access.redhat.com/errata/RHSA-2024:1866
Issue date: 2024-04-16
CVE Names: CVE-2023-6484 CVE-2023-6544 CVE-2024-1132 CVE-2024-1249
CVE-2024-1635
=====================================================================
1. Summary:
A security update is now available for Red Hat Single Sign-On 7.6 from the
Customer Portal.
This is an enhancement and security update with Important impact rating and
package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.
2. Description:
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.8 serves as a replacement for Red Hat
Single Sign-On 7.6.7, and includes bug fixes, security updates and
enhancements which are linked to in the References.
Security Fix(es):
* Authorization Bypass (CVE-2023-6544)
* Log Injection during WebAuthn authentication or registration (CVE-2023-6484)
* path transversal in redirection validation (CVE-2024-1132)
* unvalidated cross-origin messages in checkLoginIframe leads to DDoS
(CVE-2024-1249)
* undertow: Out-of-memory Error after several closed connections with wildfly-
http-client protocol (CVE-2024-1635)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in the
References section.
3. Solution:
Before applying the update, back up your existing installation, including all
applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in
to download the update).
4. Bugs fixed (https://bugzilla.redhat.com/):
2248423 - CVE-2023-6484 - keycloak: Log Injection during WebAuthn authentication
or registration
2253116 - CVE-2023-6544 - keycloak: Authorization Bypass
2262117 - CVE-2024-1132 - keycloak: path transversal in redirection validation
2262918 - CVE-2024-1249 - keycloak: org.keycloak.protocol.oidc: unvalidated
cross-origin messages in checkLoginIframe leads to DDoS
2264928 - CVE-2024-1635 - undertow: Out-of-memory Error after several closed
connections with wildfly-http-client protocol
5. References:
https://access.redhat.com/security/cve/CVE-2023-6484
https://access.redhat.com/security/cve/CVE-2023-6544
https://access.redhat.com/security/cve/CVE-2024-1132
https://access.redhat.com/security/cve/CVE-2024-1249
https://access.redhat.com/security/cve/CVE-2024-1635
https://access.redhat.com/security/updates/classification/#important
- --------------------------END INCLUDED TEXT----------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================