Red Hat Single Sign-On 7.6.11 for RHEL 7 is a security update that fixes two vulnerabilities in the Keycloak-based authentication server. CVE-2024-8698 involves improper verification of SAML responses that could allow privilege escalation. CVE-2024-8883 involves vulnerable redirect URI validation that could lead to open redirect attacks. The update replaces version 7.6.10 and includes these security fixes along with other bug fixes and enhancements. The vendor advisory classifies the update as important but states the security impact as none, with no CVSS scores provided. The update is available as RPM packages for RHEL 7 x86_64 and requires prior errata to be applied.

The vulnerabilities fixed in this update could allow an attacker to escalate privileges via improper SAML response verification and perform open redirect attacks due to vulnerable redirect URI validation. These issues could impact authentication and authorization processes in Red Hat Single Sign-On 7.6. Prior to this update, these vulnerabilities posed a high severity risk. The Red Hat advisory does not report any known exploits in the wild. The update mitigates these risks by correcting the verification and validation mechanisms.

Red Hat has released version 7.6.11 of Single Sign-On for RHEL 7 that addresses these vulnerabilities. Users should apply this update to remediate the issues. Before applying the update, ensure all previously released errata relevant to the system have been installed. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated or required beyond applying the official update.