Red Hat Single Sign-On: CVSS (Max): 8.1

April 18, 2024

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2024.2388
Red Hat Single Sign-On 7.6.8 security update on RHEL 8
18 April 2024

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: Red Hat Single Sign-On
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2024-1635 CVE-2023-6484 CVE-2023-6544
CVE-2024-1132 CVE-2024-1249

Original Bulletin:
https://access.redhat.com/errata/RHSA-2024:1861

Comment: CVSS (Max): 8.1 CVE-2024-1132 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

– ————————–BEGIN INCLUDED TEXT——————–

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat Single Sign-On 7.6.8 security
update on RHEL 8
Advisory ID: RHSA-2024:1861
Product: Red Hat Single Sign-On 7.6 for RHEL 8
Advisory URL: https://access.redhat.com/errata/RHSA-2024:1861
Issue date: 2024-04-16
CVE Names: CVE-2023-6484 CVE-2023-6544 CVE-2024-1132 CVE-2024-1249
CVE-2024-1635
=====================================================================

1. Summary:

New Red Hat Single Sign-On 7.6.8 deliverables are now available for Red Hat
Enterprise Linux 8.

This is an enhancement and security update with Important impact rating and
package name ‘rh-sso7-keycloak’. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Single Sign-On 7.6 for RHEL 8 – noarch

3. Description:

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.6.8 on RHEL 8 serves as a replacement
for Red Hat Single Sign-On 7.6.7, and includes bug fixes, security updates and
enhancements which are linked to in the References.

Security Fix(es):

* path transversal in redirection validation (CVE-2024-1132)

* org.keycloak.protocol.oidc: unvalidated cross-origin messages in
checkLoginIframe leads to DDoS (CVE-2024-1249)

* undertow: Out-of-memory Error after several closed connections with wildfly-
http-client protocol (CVE-2024-1635)

* Authorization Bypass (CVE-2023-6544)

* Log Injection during WebAuthn authentication or registration (CVE-2023-6484)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in the
References section.

4. Solution:

For details on how to apply this update, which includes the changes described in
this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2248423 – CVE-2023-6484 – keycloak: Log Injection during WebAuthn authentication
or registration
2253116 – CVE-2023-6544 – keycloak: Authorization Bypass
2262117 – CVE-2024-1132 – keycloak: path transversal in redirection validation
2262918 – CVE-2024-1249 – keycloak: org.keycloak.protocol.oidc: unvalidated
cross-origin messages in checkLoginIframe leads to DDoS
2264928 – CVE-2024-1635 – undertow: Out-of-memory Error after several closed
connections with wildfly-http-client protocol

6. Package List:

Red Hat Single Sign-On 7.6 for RHEL 8

noarch:
rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el8sso.noarch.rpm
rh-sso7-keycloak-server-0:18.0.13-1.redhat_00001.1.el8sso.noarch.rpm

Source:
rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el8sso.src.rpm

7. References:

https://access.redhat.com/security/cve/CVE-2023-6484
https://access.redhat.com/security/cve/CVE-2023-6544
https://access.redhat.com/security/cve/CVE-2024-1132
https://access.redhat.com/security/cve/CVE-2024-1249
https://access.redhat.com/security/cve/CVE-2024-1635
https://access.redhat.com/security/updates/classification/#important/

– ————————–END INCLUDED TEXT———————-

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================Security BulletinsRead More