CVE-2024-0560: Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions

Published Jan 15, 2024
·
Updated

A vulnerability was found in 3Scale when using with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the authtype is use3scaleoidcissuerendpoint, Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO 7.5. As the result, the policy doesn't inspect tokens; it determines that all tokens are valid.

Using an alternate authtype: authtype: clientid+clientsecret. Disabling the policy entirely might be a temporary solution if the alternate {{authtype is not feasible for some reason. The only purpose the token introspection endpoint serves is for sessions which are revoked in RH SSO before the standard TTL expires via the exp claim.

Other sources

A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the authtype is use3scaleoidcissuerendpoint, the Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.

NVD

Affected Software

5 affected components
All of the following
redhat 3scale
redhat keycloak=15.0.0
Red Hat Single Sign-On>=7.5.0
Keycloak Keycloak>=15
Red Hat 3scale

Event History

Jan 15, 2024
Data Sourced
via Red Hat·01:16 PM
DescriptionSeverityAffected Software
Feb 28, 2024
CVE Published
via MITRE·04:37 PM
Data Sourced
via MITRE·04:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2024-0560?

CVE-2024-0560 has been classified as a moderate severity vulnerability.

2

How do I fix CVE-2024-0560?

To fix CVE-2024-0560, you should upgrade to the latest versions of Red Hat 3scale or Keycloak as recommended by the vendor.

3

What systems are affected by CVE-2024-0560?

CVE-2024-0560 affects Red Hat 3scale and Keycloak 15.0.0 as well as Red Hat Single Sign-On version 7.5.0 and above.

4

What type of vulnerability is CVE-2024-0560?

CVE-2024-0560 is an information disclosure vulnerability related to token introspection endpoint handling.

5

Is there a workaround for CVE-2024-0560?

Currently, the best course of action for CVE-2024-0560 is to implement the recommended upgrades, as no specific workarounds have been provided.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203