Threats Tagged 'cve-2024-10451'

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.

A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.

Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.0.6 clusters. This erratum releases new images for Red Hat build of Keycloak 26.0.6 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451) * Keycloak Denial of Service (CVE-2024-10270) * Keycloak path trasversal (CVE-2024-10492) * Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666) * Keycloak TLS passthrough (CVE-2024-10039)

Red Hat build of Keycloak 24.0.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451) * Keycloak Denial of Service (CVE-2024-10270) * Keycloak path trasversal (CVE-2024-10492) * Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666) * Keycloak TLS passthrough (CVE-2024-10039)

Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 24.0.9 clusters. This erratum releases new images for Red Hat build of Keycloak 24.0.9 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451) * Keycloak Denial of Service (CVE-2024-10270) * Keycloak path trasversal (CVE-2024-10492) * Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666) * Keycloak TLS passthrough (CVE-2024-10039)