This advisory covers security fixes in the Red Hat build of Keycloak 22.0.12 and its Operator for OpenShift. The addressed vulnerabilities include CVE-2024-4629, which allows potential bypass of brute force protection mechanisms; CVE-2024-7341, a session fixation vulnerability in Elytron SAML adapters; and CVE-2024-5967, which leaks configured LDAP bind credentials via the Keycloak admin console. The update involves new container images for on-premise or private cloud deployments on OpenShift Container Platform. No CVSS scores are provided, but the vendor rates the severity as moderate.

Successful exploitation of these vulnerabilities could allow attackers to bypass brute force protections, potentially enabling unauthorized access attempts; fixate sessions in SAML authentication flows, which could lead to session hijacking; and obtain sensitive LDAP bind credentials through the admin console, risking credential exposure. These issues affect authentication and credential confidentiality components of Keycloak, potentially undermining the security of centralized login and user management services.

Red Hat has released updated container images for Keycloak 22.0.12 and its Operator that address these vulnerabilities. Users should back up their existing installations, including applications, configurations, and databases, before applying the update. Applying the updated images is the recommended remediation. No additional mitigation steps are indicated or required beyond updating to the fixed images.