This advisory covers security fixes in the Red Hat build of Keycloak 24.0.9, a containerized authentication server for OpenShift. The update addresses five CVEs: CVE-2024-10451 (sensitive data exposure in the build process), CVE-2024-10270 (denial of service), CVE-2024-10492 (path traversal), CVE-2024-9666 (proxy header handling denial-of-service), and CVE-2024-10039 (TLS passthrough). These vulnerabilities affect the Keycloak server and related components and could impact authentication services. Red Hat provides updated container images and an operator for deployment and management of Keycloak clusters on OpenShift. The advisory recommends applying this update after ensuring all prior relevant errata are installed.

The vulnerabilities collectively could lead to sensitive data exposure, denial-of-service conditions, and unauthorized path traversal within the Keycloak authentication server environment. This could disrupt authentication services or expose sensitive information in environments using the affected Red Hat build of Keycloak 24.0.9 images. No known exploits in the wild have been reported at this time.

Red Hat has released updated container images for the Red Hat build of Keycloak 24.0.9 that address these vulnerabilities. Users should apply this update promptly after confirming that all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified beyond applying the updated images.