This advisory covers security fixes in Red Hat build of Keycloak 26.0.6 container images used on OpenShift Container Platform. The vulnerabilities addressed include CVE-2024-9666 (proxy header handling denial-of-service), CVE-2024-10039 (TLS passthrough issue), CVE-2024-10270 (denial-of-service), CVE-2024-10451 (sensitive data exposure in build process), and CVE-2024-10492 (path traversal). The update releases new container images and an updated Keycloak Operator to remediate these issues. The advisory references errata RHSA-2024:10177 and instructs users to apply this update after ensuring all prior errata are applied.

The vulnerabilities collectively could allow denial-of-service conditions, unauthorized access to sensitive data during the build process, and path traversal attacks within the Keycloak authentication server environment. These issues could disrupt authentication services or expose sensitive information in containerized deployments on OpenShift. The severity is rated high, indicating significant risk if unpatched.

Red Hat has released updated container images for Keycloak 26.0.6 and the corresponding Operator to address these vulnerabilities. Users should apply these updated images as provided in errata RHSA-2024:10177. Before applying this update, ensure all previously released relevant errata are installed. Follow Red Hat's official guidance at https://access.redhat.com/articles/11258 for update procedures. No additional mitigations are specified beyond applying the updated images.