This advisory covers security fixes in the Red Hat build of Keycloak 24.0.9 container images and its Operator for OpenShift. The vulnerabilities addressed include CVE-2024-9666, a denial-of-service vulnerability in proxy header handling; CVE-2024-10039 related to TLS passthrough; CVE-2024-10270, a denial-of-service issue; CVE-2024-10451 involving sensitive data exposure in the build process; and CVE-2024-10492, a path traversal vulnerability. These issues affect the authentication server functionality provided by Keycloak in containerized OpenShift environments. The advisory provides updated images to remediate these vulnerabilities aligning with the standalone Keycloak product release.

The vulnerabilities collectively could allow denial-of-service conditions, exposure of sensitive data during the build process, and unauthorized path traversal within the Keycloak service. These issues impact the security and availability of authentication services managed by Keycloak in OpenShift containerized deployments. No known exploits in the wild have been reported at the time of this advisory. The severity is assessed as high due to the potential impact on authentication service reliability and confidentiality.

Red Hat has released updated container images for Keycloak 24.0.9 and the associated Operator that address these vulnerabilities. Users should apply these updated images as soon as possible. Before applying this update, ensure all previously released relevant errata have been applied. Detailed update instructions are available from Red Hat's official documentation at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the updated images.