A bug update is now available for Red Hat build of Keycloak 22.0.10 images
 running on OpenShift Container Platform. This is an enhancement and security update with Moderate impact rating.

Red Hat build of Keycloak 22.0.10 is an integrated solution, available as a Red
 Hat JBoss Middleware for OpenShift containerized image, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security Fix(es):

* Authorization Bypass (CVE-2023-6544)
* XSS via assertion consumer service URL in SAML POST-binding flow
 (CVE-2023-6717)
* path transversal in redirection validation (CVE-2024-1132)
* unvalidated cross-origin messages in checkLoginIframe leads to DDoS
 (CVE-2024-1249)
* path traversal in the redirect validation (CVE-2024-2419)
* secondary factor bypass in step-up authentication (CVE-2023-3597)
* impersonation via logout token exchange (CVE-2023-0657)
* session hijacking via re-authentication (CVE-2023-6787)
* keycloak-rhel9-operator-bundle-container: Log Injection during WebAuthn
 authentication or registration (CVE-2023-6484)
* keycloak-rhel9-operator-container: Log Injection during WebAuthn
 authentication or registration (CVE-2023-6484)

This erratum releases a bug update and enhancement images for Red Hat build of
 Keycloak 22.0.10 for use within the OpenShift Container Platform 4.12, 4.13, 4.14 and 4.15 cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-0657: Improper Check for Dropped Privileges (CWE-273)
CVE-2023-3597: Improper Authentication (CWE-287)
CVE-2023-6484: Improper Output Neutralization for Logs (CWE-117)
CVE-2023-6544: Permissive Regular Expression (CWE-625)
CVE-2023-6717: Improper Neutralization of Input During Web Page Generation
 ('Cross-site Scripting') (CWE-79)
CVE-2023-6787: Improper Authentication (CWE-287)
CVE-2024-1132: Improper Limitation of a Pathname to a Restricted Directory
 ('Path Traversal') (CWE-22)
CVE-2024-1249: Origin Validation Error (CWE-346)
CVE-2024-2419: URL Redirection to Untrusted Site ('Open Redirect')
 (CWE-601)