Red Hat Keycloak Security Advisory: CVE-2024-8698 Privilege Escalation and CVE-2024-8883 Open Redirect

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: RHSA-2024:6384 2. Release Date: 2024-09-19 3. Type/Severity: Security Advisory: Important 4. Affected Products: Red Hat build of Keycloak 24.0.8 and Red Hat build of Keycloak 24.0.8 Operator 5. Issue Description: - New images with important security impacts, applicable to Red Hat build of Keycloak 24.0.8 and Red Hat build of Keycloak 24.0.8 Operator, running on OpenShift Container Platform. - Provides an integrated login solution as part of Red Hat JBoss Middleware for OpenShift containerized images. - Offers an authentication server for centralized login, logout, and registration. - Enables management of user accounts in web applications, mobile applications, and RESTful web services. - Provides an OpenShift Operator to simplify deployment and management of Keycloak 24.0.8 clusters. 6. Security Fixes: - Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak (CVE-2024-8698) - Vulnerable Redirect URI Validation Results in Open Redirect (CVE-2024-8883) 7. Solution: Before applying the update, back up existing installations, including all applications, configuration files, databases, and database settings. 8. Affected Products: Red Hat build of Keycloak Text-only Advisories x86_64 9. Fixes: - BZ-2311641 - CVE-2024-8698 keycloak-saml-core: Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak - BZ-2312511 - CVE-2024-8883 Keycloak: Vulnerable Redirect URI Validation Results in Open Redirect 10. CVEs: - CVE-2024-8698 - CVE-2024-8883 11. Reference Links: - https://access.redhat.com/security/updates/classification/#important This information provides detailed descriptions of the vulnerability, affected products, security fixes, and solutions.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Keycloak Security Advisory: CVE-2024-8698 Privilege Escalation and CVE-2024-8883 Open Redirect

More from this source