REDHAT-BUG-2258456: Medium severity red hat 3scale api management vulnerability
A vulnerability was found in 3Scale when using with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the authtype is use3scaleoidcissuerendpoint, Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO 7.5. As the result, the policy doesn't inspect tokens; it determines that all tokens are valid.
Using an alternate authtype: authtype: clientid+clientsecret. Disabling the policy entirely might be a temporary solution if the alternate {{authtype is not feasible for some reason. The only purpose the token introspection endpoint serves is for sessions which are revoked in RH SSO before the standard TTL expires via the exp claim.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2258456?
The vulnerability REDHAT-BUG-2258456 is categorized as a moderate severity issue.
How do I fix REDHAT-BUG-2258456?
To fix REDHAT-BUG-2258456, users should update to the latest version of Red Hat 3Scale or Red Hat RH-SSO that addresses the identified vulnerability.
What versions are affected by REDHAT-BUG-2258456?
REDHAT-BUG-2258456 affects Red Hat 3Scale starting from version 15 and Red Hat RH-SSO from version 7.5.0.
What types of software does REDHAT-BUG-2258456 impact?
REDHAT-BUG-2258456 impacts both Red Hat 3Scale and Red Hat Single Sign-On (RH-SSO) software.
What is the cause of REDHAT-BUG-2258456?
The cause of REDHAT-BUG-2258456 is the use of the removed token_introspection_endpoint field when auth_type is set to use_3scale_oidc_issuer_endpoint.