The Red Hat build of Keycloak 24.0.9 contains multiple security vulnerabilities, including a denial-of-service vulnerability caused by improper proxy header handling (CVE-2024-9666), sensitive data exposure in the build process (CVE-2024-10451), path traversal (CVE-2024-10492), additional denial-of-service issues (CVE-2024-10270), and a TLS passthrough vulnerability (CVE-2024-10039). These issues affect the standalone Keycloak server used for authentication and single sign-on. Red Hat has released updated packages addressing these vulnerabilities and recommends applying these updates after backing up existing installations. The advisory is classified as important with a high severity level, but no CVSS scores are provided. No exploits have been observed in the wild.

Successful exploitation of these vulnerabilities could lead to denial-of-service conditions, unauthorized exposure of sensitive data during the build process, and path traversal attacks potentially allowing unauthorized file access. The TLS passthrough vulnerability may affect secure communications. These issues could disrupt authentication services and compromise confidentiality or availability of the Keycloak server.

Red Hat has released updated packages for the Red Hat build of Keycloak 24.0.9 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the updates available from the Red Hat Customer Portal. Applying these official updates is the recommended remediation. No additional vendor advisories indicate that no action is required or that the issues are already mitigated.