This security advisory from Red Hat addresses two vulnerabilities in the Red Hat build of Keycloak 22.0.13. CVE-2024-8698 is an improper verification of SAML responses vulnerability that can lead to privilege escalation. CVE-2024-8883 is a vulnerability in redirect URI validation that results in an open redirect issue. Red Hat has released new container images for Keycloak 22.0.13 and its operator to fix these issues. The update aligns with the standalone Keycloak product release and is intended for deployments on the OpenShift Container Platform. No CVSS scores are provided in the advisory.

Successful exploitation of CVE-2024-8698 could allow an attacker to escalate privileges by exploiting improper verification of SAML responses. CVE-2024-8883 could allow an attacker to perform open redirect attacks due to vulnerable redirect URI validation. Both vulnerabilities pose a high security risk as indicated by the vendor. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated container images for the Red Hat build of Keycloak 22.0.13 and its operator that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the updated images is the recommended remediation. Patch status is confirmed by the vendor advisory, indicating an official fix is available.