This advisory covers three security vulnerabilities in Red Hat build of Keycloak 22.0.12: CVE-2024-4629, which involves a potential bypass of brute force protection; CVE-2024-7341, a session fixation vulnerability in elytron SAML adapters; and CVE-2024-5967, a leak of configured LDAP bind credentials via the Keycloak admin console. These issues could affect authentication and session management security. The update to version 22.0.12 addresses these vulnerabilities and serves as a replacement for Red Hat Single Sign-On 7.6. The advisory does not provide a CVSS score but rates the impact as moderate.

The vulnerabilities could allow attackers to bypass brute force protection mechanisms, fixate sessions in SAML adapters potentially leading to session hijacking, and leak sensitive LDAP bind credentials through the admin console. These issues could compromise authentication integrity and confidentiality of credentials in affected deployments.

Red Hat has released an updated package for Red Hat build of Keycloak 22.0.12 that addresses these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying this update is the recommended remediation. No additional mitigations or workarounds are specified in the advisory.