csaf_redhat - rhsa-2024

rhsa-2024_1865

Vulnerability from csaf_redhat

Published

2024-04-16 20:16

Modified

2024-11-06 05:29

Summary

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.8 Operator enhancement and security update

Notes

Topic

Red Hat Single Sign-On 7.6.8 Operator enhancement and security update. This is an enhancement and security update with Low impact rating and package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Red Hat Single Sign-On 7.6.8 Operator for OpenShift simplifies deployment and management of Single-Sign-On 7.6.8 clusters. The Operator is supported on Red Hat OpenShift Container Platform 4.9. Security Fix(es): * Log Injection during WebAuthn authentication or registration (CVE-2023-6484)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Single Sign-On 7.6.8 Operator enhancement and security update.\n\nThis is an enhancement and security update with Low impact rating and\npackage name \u0027rh-sso7-keycloak\u0027. A Common Vulnerability Scoring System (CVSS)\nbase score, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Single Sign-On 7.6.8 Operator for OpenShift\nsimplifies deployment and management of Single-Sign-On 7.6.8 clusters. The\nOperator is supported on Red Hat OpenShift Container Platform 4.9.\n\nSecurity Fix(es):\n\n* Log Injection during WebAuthn authentication or registration (CVE-2023-6484)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:1865",
        "url": "https://access.redhat.com/errata/RHSA-2024:1865"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "2248423",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248423"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1865.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.8 Operator enhancement and security update",
    "tracking": {
      "current_release_date": "2024-11-06T05:29:26+00:00",
      "generator": {
        "date": "2024-11-06T05:29:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2024:1865",
      "initial_release_date": "2024-04-16T20:16:34+00:00",
      "revision_history": [
        {
          "date": "2024-04-16T20:16:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-04-16T20:16:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-06T05:29:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Middleware Containers for OpenShift",
                "product": {
                  "name": "Middleware Containers for OpenShift",
                  "product_id": "8Base-RHOSE-Middleware",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhosemc:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x",
                "product": {
                  "name": "rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x",
                  "product_id": "rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196?arch=s390x\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-init-container\u0026tag=7.6-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x",
                "product": {
                  "name": "rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x",
                  "product_id": "rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a?arch=s390x\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-operator\u0026tag=7.6-18"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64",
                "product": {
                  "name": "rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64",
                  "product_id": "rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-init-container\u0026tag=7.6-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64",
                "product": {
                  "name": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64",
                  "product_id": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-operator-bundle\u0026tag=7.6.8-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64",
                "product": {
                  "name": "rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64",
                  "product_id": "rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-operator\u0026tag=7.6-18"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le",
                "product": {
                  "name": "rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le",
                  "product_id": "rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-init-container\u0026tag=7.6-16"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le",
                "product": {
                  "name": "rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le",
                  "product_id": "rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-operator\u0026tag=7.6-18"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64"
        },
        "product_reference": "rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x"
        },
        "product_reference": "rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le"
        },
        "product_reference": "rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64"
        },
        "product_reference": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x"
        },
        "product_reference": "rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le"
        },
        "product_reference": "rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64 as a component of Middleware Containers for OpenShift",
          "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64"
        },
        "product_reference": "rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64",
        "relates_to_product_reference": "8Base-RHOSE-Middleware"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-6484",
      "cwe": {
        "id": "CWE-117",
        "name": "Improper Output Neutralization for Logs"
      },
      "discovery_date": "2023-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2248423"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak: Log Injection during WebAuthn authentication or registration",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x",
          "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64",
          "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x",
          "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le",
          "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-6484"
        },
        {
          "category": "external",
          "summary": "RHBZ#2248423",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248423"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6484",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-6484"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6484",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6484"
        }
      ],
      "release_date": "2023-12-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-16T20:16:34+00:00",
          "details": "To install the Red Hat Single Sign-On Operator, use the Operator Marketplace\ninterface in OpenShift Container Platform.",
          "product_ids": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:1865"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:7c11cf4ea78020a3fba69c85e56c1c1eed08af61e7215dae5dcf7425f341b79d_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:d89710eaa9b45dc180c311bd020255759383b0eb07826265e4ba810c6a047196_s390x",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-init-container@sha256:f02e961e0c796ac8b65de30a5c364c63337003ba9d2b05b7041565cf3bd9d8c0_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:81208c494048b526ff577b0c9673f4e310e84627671d2da7ac072aa11292aedc_amd64",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:586edd67e9b88b7f11bcec01308ef66aa20f7fd7307b821c1e6da5dbdee0786a_s390x",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:990daa5745e5c3ba9da0087a0198de272027794949b8c5f45b86023702bfe8a0_ppc64le",
            "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator@sha256:bc38682492e8166dca7a08d0eae81469270b5f979ff80f075bc63183126098c0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak: Log Injection during WebAuthn authentication or registration"
    }
  ]
}

cve-2023-6484

Vulnerability from cvelistv5

Published

2024-04-25 15:58

Modified

2024-09-16 17:37

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

Keycloak: log injection during webauthn authentication or registration

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2024:0798	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0799	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0800	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0801	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0804	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1860	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1861	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1862	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1864	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1865	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1866	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1867	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:1868	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-6484	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2248423	issue-tracking, x_refsource_REDHAT

Impacted products

▼	Vendor	Product
	Red Hat	Red Hat build of Keycloak 22
	Red Hat	Red Hat build of Keycloak 22
	Red Hat	Red Hat build of Keycloak 22
	Red Hat	Red Hat build of Keycloak 22.0.10
	Red Hat	Red Hat Single Sign-On 7
	Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7
	Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7
	Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8
	Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8
	Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9
	Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9
	Red Hat	RHEL-8 based Middleware Containers
	Red Hat	RHEL-8 based Middleware Containers
	Red Hat	RHEL-8 based Middleware Containers
	Red Hat	RHEL-8 based Middleware Containers
	Red Hat	RHEL-8 based Middleware Containers
	Red Hat	RHSSO 7.6.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.872Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:0798",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0798"
          },
          {
            "name": "RHSA-2024:0799",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0799"
          },
          {
            "name": "RHSA-2024:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0800"
          },
          {
            "name": "RHSA-2024:0801",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0801"
          },
          {
            "name": "RHSA-2024:0804",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0804"
          },
          {
            "name": "RHSA-2024:1860",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1860"
          },
          {
            "name": "RHSA-2024:1861",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1861"
          },
          {
            "name": "RHSA-2024:1862",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1862"
          },
          {
            "name": "RHSA-2024:1864",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1864"
          },
          {
            "name": "RHSA-2024:1865",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1865"
          },
          {
            "name": "RHSA-2024:1866",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1866"
          },
          {
            "name": "RHSA-2024:1867",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1867"
          },
          {
            "name": "RHSA-2024:1868",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:1868"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-6484"
          },
          {
            "name": "RHBZ#2248423",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248423"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-12T14:33:06.444846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-12T14:33:17.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:22::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 22",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "22.0.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:22::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 22",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "22-13",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:22::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 22",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "22-16",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:22"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat build of Keycloak 22.0.10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7.6 for RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:18.0.12-1.redhat_00001.1.el7sso",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7.6 for RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:18.0.13-1.redhat_00001.1.el7sso",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7.6 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:18.0.12-1.redhat_00001.1.el8sso",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7.6 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:18.0.13-1.redhat_00001.1.el8sso",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7.6 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:18.0.12-1.redhat_00001.1.el9sso",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso7-keycloak",
          "product": "Red Hat Single Sign-On 7.6 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:18.0.13-1.redhat_00001.1.el9sso",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso-7/sso76-openshift-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.6-41",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso-7/sso76-openshift-rhel8",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.6-46",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso-7/sso7-rhel8-init-container",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.6-16",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso-7/sso7-rhel8-operator",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.6-18",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhosemc:1.0::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-sso-7/sso7-rhel8-operator-bundle",
          "product": "RHEL-8 based Middleware Containers",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "7.6.8-2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-rhel9-operator-bundle-container",
          "product": "RHSSO 7.6.8",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2023-12-04T00:00:00+00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T17:37:48.100Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:0798",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0798"
        },
        {
          "name": "RHSA-2024:0799",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0799"
        },
        {
          "name": "RHSA-2024:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0800"
        },
        {
          "name": "RHSA-2024:0801",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0801"
        },
        {
          "name": "RHSA-2024:0804",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0804"
        },
        {
          "name": "RHSA-2024:1860",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1860"
        },
        {
          "name": "RHSA-2024:1861",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1861"
        },
        {
          "name": "RHSA-2024:1862",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1862"
        },
        {
          "name": "RHSA-2024:1864",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1864"
        },
        {
          "name": "RHSA-2024:1865",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1865"
        },
        {
          "name": "RHSA-2024:1866",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1866"
        },
        {
          "name": "RHSA-2024:1867",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1867"
        },
        {
          "name": "RHSA-2024:1868",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1868"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-6484"
        },
        {
          "name": "RHBZ#2248423",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2248423"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-11-06T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2023-12-04T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Keycloak: log injection during webauthn authentication or registration",
      "x_redhatCweChain": "CWE-117: Improper Output Neutralization for Logs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-6484",
    "datePublished": "2024-04-25T15:58:18.169Z",
    "dateReserved": "2023-12-04T10:48:43.809Z",
    "dateUpdated": "2024-09-16T17:37:48.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted