This advisory covers three security vulnerabilities in Red Hat Single Sign-On 7.6.10 for OpenShift: CVE-2024-4629, a potential bypass of brute force protection; CVE-2024-7341, a session fixation vulnerability in Elytron SAML adapters; and CVE-2024-5967, a leak of configured LDAP bind credentials via the Keycloak admin console. These issues could allow attackers to bypass authentication protections, fixate sessions, or gain unauthorized access to sensitive credentials. The vendor has released an updated container image for Red Hat Single Sign-On 7.6.10 aligning with the standalone product release, intended for deployment on OpenShift Container Platform 3.10, 3.11, and 4.3. The advisory provides detailed update instructions and emphasizes the importance of applying the new image to remediate these vulnerabilities.

The vulnerabilities impact authentication security and credential confidentiality in Red Hat Single Sign-On for OpenShift. The brute force protection bypass could allow attackers to circumvent rate limiting or lockout mechanisms. Session fixation could enable attackers to hijack user sessions. Leakage of LDAP bind credentials through the admin console risks exposure of sensitive authentication credentials. These issues collectively weaken the security posture of the authentication server, potentially allowing unauthorized access or credential compromise. The advisory rates the overall impact as moderate.

Red Hat has released an updated Red Hat Single Sign-On 7.6.10 container image for OpenShift that addresses these vulnerabilities. Users should update to this latest image by following the vendor's documented steps, which include replacing specific resource templates and importing the updated image streams in the OpenShift 'openshift' project. Applying this update mitigates the identified security issues. No additional mitigations are specified or required beyond applying the official update.