Red Hat Security Advisory: Red Hat build of Keycloak 24.0.7 Images Update

This advisory addresses three moderate severity vulnerabilities in Red Hat build of Keycloak prior to version 24.0.7. CVE-2024-7341 is a session fixation vulnerability in Elytron SAML adapters that could allow an attacker to fix a user's session identifier. CVE-2024-7318 involves the One Time Passcode (OTP) mechanism where OTPs remain valid longer than their intended expiration time, potentially allowing unauthorized use. CVE-2024-7260 is an open redirect vulnerability on the account page, which could be exploited to redirect users to malicious sites. Red Hat has released updated container images and packages for Keycloak 24.0.7 to remediate these issues. Users should back up their existing configurations and apply the update promptly.

The vulnerabilities could allow attackers to hijack user sessions (session fixation), exploit OTPs beyond their expiration to bypass authentication controls, and redirect users to potentially malicious external sites via the open redirect flaw. These issues could undermine the security of authentication and user session management in environments using affected Keycloak versions, potentially leading to unauthorized access or phishing attacks. However, no known exploits in the wild have been reported at this time.

A patch is available in Red Hat build of Keycloak version 24.0.7. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Deploying the updated Keycloak 24.0.7 images or packages will remediate the session fixation, OTP validity, and open redirect vulnerabilities. No additional vendor-recommended mitigations are specified beyond applying the update.