Red Hat Single Sign-On 7.6.10 for RHEL 8, based on the Keycloak project, fixes three security vulnerabilities: CVE-2024-4629 allows potential bypass of brute force protection; CVE-2024-7341 addresses session fixation issues in Elytron SAML adapters; CVE-2024-5967 fixes leakage of LDAP bind credentials via the Keycloak admin console. These issues could impact authentication security and credential confidentiality. The update supersedes version 7.6.9 and is distributed as RPM packages for RHEL 8. Red Hat rates the security impact as moderate and recommends applying the update after prior errata are installed. No active exploits are known in the wild at this time.

The vulnerabilities could allow attackers to bypass brute force protections, fixate sessions in SAML adapters potentially leading to session hijacking, and leak LDAP bind credentials through the admin console, compromising authentication security and confidentiality of credentials. The overall impact is rated moderate by Red Hat. No known active exploitation has been reported.

Red Hat has released Red Hat Single Sign-On 7.6.10 for RHEL 8 which addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official update.