This security advisory covers updates to the Red Hat build of Keycloak 22.0.12 container images and operator for OpenShift. The update addresses three vulnerabilities: CVE-2024-4629, a potential bypass of brute force protection; CVE-2024-7341, a session fixation issue in Elytron SAML adapters; and CVE-2024-5967, which leaks configured LDAP bind credentials via the Keycloak admin console. These vulnerabilities affect the authentication and session management components of Keycloak, potentially impacting user authentication security and credential confidentiality. The advisory provides new images aligned with the standalone Keycloak 22.0.12 release for deployment on OpenShift Container Platform.

The vulnerabilities could allow attackers to bypass brute force protection mechanisms, fixate sessions in SAML adapters potentially leading to unauthorized session use, and leak sensitive LDAP bind credentials through the admin console. These issues may compromise authentication security and confidentiality of credentials in affected Keycloak deployments. The overall impact is rated moderate by Red Hat.

Red Hat has released updated container images for Keycloak 22.0.12 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Deploying the new images will mitigate the identified security issues. No additional mitigation steps are specified or required beyond applying the update.