Headline
Red Hat Security Advisory 2024-1865-03
Red Hat Security Advisory 2024-1865-03 - Red Hat Single Sign-On 7.6.8 Operator enhancement and security update.
The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1865.jsonRed Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis: Low: Red Hat Single Sign-On 7.6.8 Operator enhancement and security updateAdvisory ID: RHSA-2024:1865-03Product: Red Hat OpenShift EnterpriseAdvisory URL: https://access.redhat.com/errata/RHSA-2024:1865Issue date: 2024-04-16Revision: 03CVE Names: CVE-2023-6484====================================================================Summary: Red Hat Single Sign-On 7.6.8 Operator enhancement and security update.This is an enhancement and security update with Low impact rating andpackage name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System (CVSS)base score, which gives a detailed severity rating, is available for eachvulnerability from the CVE link(s) in the References section.Description:Red Hat Single Sign-On 7.6.8 Operator for OpenShiftsimplifies deployment and management of Single-Sign-On 7.6.8 clusters. TheOperator is supported on Red Hat OpenShift Container Platform 4.9.Security Fix(es):* Log Injection during WebAuthn authentication or registration (CVE-2023-6484)Solution:CVEs:CVE-2023-6484References:https://access.redhat.com/security/updates/classification/#lowhttps://bugzilla.redhat.com/show_bug.cgi?id=2248423Related news
A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping us improve our security.
Red Hat Security Advisory 2024-1868-03 - An update is now available for Red Hat build of Keycloak. Issues addressed include bypass, cross site scripting, and denial of service vulnerabilities.
Red Hat Security Advisory 2024-0804-03 - A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. Issues addressed include bypass, cross site scripting, and open redirection vulnerabilities.
Red Hat Security Advisory 2024-0801-03 - A new image is available for Red Hat Single Sign-On 7.6.7, running on OpenShift Container Platform 3.10 and 3.11, and 4.3. Issues addressed include bypass, cross site scripting, and open redirection vulnerabilities.
Red Hat Security Advisory 2024-0800-03 - New Red Hat Single Sign-On 7.6.7 packages are now available for Red Hat Enterprise Linux 9. Issues addressed include bypass, cross site scripting, and open redirection vulnerabilities.
Red Hat Security Advisory 2024-0799-03 - New Red Hat Single Sign-On 7.6.7 packages are now available for Red Hat Enterprise Linux 8. Issues addressed include bypass, cross site scripting, and open redirection vulnerabilities.
Red Hat Security Advisory 2024-0798-03 - New Red Hat Single Sign-On 7.6.7 packages are now available for Red Hat Enterprise Linux 7. Issues addressed include bypass, cross site scripting, and open redirection vulnerabilities.