rhsa-2024:6503
Vulnerability from csaf_redhat
Published
2024-09-09 16:05
Modified
2025-05-02 21:49
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Update

Notes

Topic
New Red Hat build of Keycloak 24.0.7 packages are available from the Customer Portal
Details
Red Hat build of Keycloak 24.0.7 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * session fixation in elytron saml adapters (CVE-2024-7341) * One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318) * Open Redirect on Account page (CVE-2024-7260)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New Red Hat build of Keycloak 24.0.7 packages are available from the Customer Portal",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak 24.0.7 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nSecurity fixes:\n* session fixation in elytron saml adapters (CVE-2024-7341)\n* One Time Passcode (OTP) is valid longer than expiration timeSeverity (CVE-2024-7318)\n* Open Redirect on Account page (CVE-2024-7260)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:6503",
        "url": "https://access.redhat.com/errata/RHSA-2024:6503"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2301875",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
      },
      {
        "category": "external",
        "summary": "2301876",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
      },
      {
        "category": "external",
        "summary": "2302064",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6503.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Update",
    "tracking": {
      "current_release_date": "2025-05-02T21:49:28+00:00",
      "generator": {
        "date": "2025-05-02T21:49:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.4.3"
        }
      },
      "id": "RHSA-2024:6503",
      "initial_release_date": "2024-09-09T16:05:49+00:00",
      "revision_history": [
        {
          "date": "2024-09-09T16:05:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-09-09T16:05:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-05-02T21:49:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of Keycloak",
                "product": {
                  "name": "Red Hat Build of Keycloak",
                  "product_id": "Red Hat Build of Keycloak",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:24"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7260",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2024-07-31T02:53:42+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301875"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.\r\n\r\nOnce a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: Open Redirect on Account page",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform limits access to external systems and enforces strict network security boundaries through a deny-all, allow-exception system implementation. This ensures that access to external websites and systems is strictly controlled, monitored, and, if necessary, restricted. By enforcing policies on which external sites or domains users and applications can interact with, this control minimizes the risk of users being redirected to malicious websites. For example, organizations may implement allowlists of approved URLs or domains, blocking any redirections to untrusted or unauthorized sites. The platform\u0027s implementation of boundary protection includes firewalls, gateways, and intrusion detection/prevention systems. This control prevents unauthorized traffic, including malicious redirect requests, from entering or leaving the internal network. The boundary protection control can enforce URL filtering, domain allowlisting, and content inspection to block redirection attempts to known malicious domains. When configured properly, boundary protection mechanisms ensure that even if an open redirect vulnerability is exploited, the impact is limited by blocking access to harmful external sites.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301875",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301875"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7260",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7260"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7260"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:49+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "keycloak-core: Open Redirect on Account page"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Todd Cullum"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-7318",
      "cwe": {
        "id": "CWE-324",
        "name": "Use of a Key Past its Expiration Date"
      },
      "discovery_date": "2024-07-31T03:04:38+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2301876"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.\r\nA one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This finding was marked Moderate because it is a 2x increase, which is not too long.\n\nRed Hat has evaluated this vulnerability and it only affects the Red Hat Build of Keycloak (RHBK).\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-324: Use of a Key Past its Expiration Date vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform enforces strong cryptographic practices through authenticated cryptographic modules, key lifecycle management, and continuous monitoring. Module authentication ensures only authorized cryptographic modules are used, preventing reliance on unauthorized or outdated keys. Approved cryptographic methods mandate the use of federally recognized encryption standards, reducing the risk of insecure or expired key usage. Key management controls ensure secure key distribution, scheduled retirement, and enforcement of expiration dates to prevent the use of outdated keys. Revocation mechanisms allow prompt invalidation of compromised or expired keys, while system monitoring detects and responds to unauthorized key usage. Together, these controls preserve cryptographic integrity and reduce the attack surface by ensuring expired keys are promptly identified, revoked, and replaced.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2301876",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301876"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7318"
        }
      ],
      "release_date": "2024-09-09T13:55:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:49+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity"
    },
    {
      "cve": "CVE-2024-7341",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2024-07-31T15:02:21+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2302064"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. While it presents a session fixation risk, the attacker must first hijack a session before authentication. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the `turnOffChangeSessionIdOnLogin` option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Keycloak"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "RHBZ#2302064",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302064"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-7341",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-7341"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7341"
        }
      ],
      "release_date": "2024-09-09T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-09T16:05:49+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:6503"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Keycloak"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.