Threats Tagged 'cve-2024-5967'

Red Hat Single Sign-On 7.6.10 for OpenShift contains multiple security fixes addressing a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. This update is provided as a new container image for use within OpenShift Container Platform versions 3.10, 3.11, and 4.3. The vulnerabilities have a moderate impact rating and affect on-premise or private cloud deployments.

Red Hat Single Sign-On 7.6.10 for RHEL 9 addresses multiple security issues including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. This update replaces version 7.6.9 and includes bug fixes and enhancements. The vulnerabilities have been rated with moderate severity by Red Hat Product Security. No CVSS scores are provided in the advisory. The update is recommended to mitigate these security risks.

Red Hat has released updated container images for the Red Hat build of Keycloak 22.0.12 to address multiple security issues. These include a potential bypass of brute force protection, a session fixation vulnerability in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. The update is intended for use within OpenShift Container Platform deployments, including on-premise and private cloud environments. The advisory rates the impact as moderate and recommends applying the new images after backing up existing installations.

Red Hat Single Sign-On 7.6.10 for RHEL 8 addresses multiple security issues including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. This update replaces version 7.6.9 and includes bug fixes and enhancements. The vulnerabilities have been assigned CVEs CVE-2024-4629, CVE-2024-7341, and CVE-2024-5967 respectively. The security impact is rated moderate by Red Hat. No CVSS scores are provided in the advisory. The update is available as a package for Red Hat Enterprise Linux 8 and users are advised to apply it after ensuring all previous errata are installed.

Red Hat has released an update for Red Hat build of Keycloak to version 22.0.12 addressing multiple security issues. The update fixes a potential bypass of brute force protection, a session fixation vulnerability in elytron SAML adapters, and a leak of configured LDAP bind credentials through the Keycloak admin console. These vulnerabilities have a moderate impact rating. The update replaces Red Hat Single Sign-On 7.6 and includes other bug fixes and enhancements.

Red Hat Single Sign-On 7.6.10 for RHEL 7 and 8 addresses multiple security vulnerabilities including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of LDAP bind credentials through the Keycloak admin console. These issues were fixed in this update, which replaces version 7.6.9. The update is rated as having a moderate security impact by Red Hat Product Security.

Red Hat Single Sign-On 7.6.10 addresses multiple security issues including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of LDAP bind credentials through the Keycloak admin console. This update replaces version 7.6.9 and includes bug fixes and enhancements. The security impact is rated moderate by Red Hat Product Security. Users are advised to back up their installations before applying the update.

A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL  independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.

LowVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-5967