Red Hat Keycloak SAML Adapter Session Fixation Vulnerability (CVE-2024-7341) Advisory

Key Information Vulnerability Description Name: CVE-2024-7341 Type: Session Fixation Impact: SAML adapters in Keycloak Description: The Session ID and JSESSIONID cookie are not changed at login time, allowing an attacker to hijack the current session before authentication. Affected Components Component: org.keycloak/keycloak-services Status: Fixed Release Date: September 10, 2024 CVSS v3 Score Base Score: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Frequently Asked Questions Why does Red Hat's CVSS v3 score or impact differ from other vendors? My product is listed as "under investigation" or "affected," when will Red Hat release a fix for this vulnerability? What should I do if my product is listed as "will not fix"? What are mitigation strategies? I have a Red Hat product, but it is not in the list above. Is it affected? Why does my security scanner report that my product is affected by this vulnerability, even though my product version is fixed or not affected? Additional Information Release Date: September 9, 2024 Publisher: Red Hat Affected Component: org.keycloak/keycloak-services Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9 Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September 10, 2024 Publisher: Red Hat Affected Component: rhbk/keycloak-rhel9-operator Status: Fixed Release Date: September

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Keycloak SAML Adapter Session Fixation Vulnerability (CVE-2024-7341) Advisory

More from this source