rhsa-2024_6503
Vulnerability from csaf_redhat
Published
2024-09-09 16:05
Modified
2024-10-08 01:58
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Update

Notes

Topic
New Red Hat build of Keycloak 24.0.7 packages are available from the Customer Portal
Details
Red Hat build of Keycloak 24.0.7 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * session fixation in elytron saml adapters (CVE-2024-7341) * One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318) * Open Redirect on Account page (CVE-2024-7260)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New Red Hat build of Keycloak 24.0.7 packages are available from the Customer Portal",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak 24.0.7 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nSecurity fixes:\n* session fixation in elytron saml adapters (CVE-2024-7341)\n* One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318)\n* Open Redirect on Account page (CVE-2024-7260)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:6503",
        "url": "https://access.redhat.com/errata/RHSA-2024:6503"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2301875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
      },
      {
        "category": "external",
        "summary": "2301876",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
      },
      {
        "category": "external",
        "summary": "2302064",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6503.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Update",
    "tracking": {
      "current_release_date": "2024-10-08T01:58:58+00:00",
      "generator": {
        "date": "2024-10-08T01:58:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.0.1"
        }
      },
      "id": "RHSA-2024:6503",
      "initial_release_date": "2024-09-09T16:05:49+00:00",
      "revision_history": [
        {
          "date": "2024-09-09T16:05:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-09T16:05:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-10-08T01:58:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of Keycloak",
                "product": {
                  "name": "Red Hat Build of Keycloak",
                  "product_id": "Red Hat Build of Keycloak",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:24"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7260",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2024-07-31T02:53:42+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.\r\n\r\nOnce a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: Open Redirect on Account page",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7260",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-core: Open Redirect on Account page"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7318",
      "cwe": {
        "id": "CWE-324",
        "name": "Use of a Key Past its Expiration Date"
      },
      "discovery_date": "2024-07-31T03:04:38+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301876"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.\r\nA one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This finding was marked Moderate because it is a 2x increase, which is not too long.\n\nRed Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301876",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity"
    },
    {
      "cve": "CVE-2024-7341",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2024-07-31T15:02:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2302064"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. While it presents a session fixation risk, the attacker must first hijack a session before authentication. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the `turnOffChangeSessionIdOnLogin` option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "RHBZ#2302064",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341"
        }
      ],
      "release_date": "2024-09-09T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.