REDHAT-BUG-2311641
First published: Wed Sep 11 2024(Updated: )
The SAML signature validation method in Keycloak uses the position of the signature within the XML document to determine if the signature is for the full document or an assertion. This approach can be exploited by attackers to bypass signature validation and perform unauthorized actions.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Build of Keycloak |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:6878
- https://access.redhat.com/errata/RHSA-2024:6879
- https://access.redhat.com/errata/RHSA-2024:6880
- https://access.redhat.com/errata/RHSA-2024:6882
- https://access.redhat.com/errata/RHSA-2024:6886
- https://access.redhat.com/errata/RHSA-2024:6888
- https://access.redhat.com/errata/RHSA-2024:6890
- https://access.redhat.com/errata/RHSA-2024:6887
- https://access.redhat.com/errata/RHSA-2024:6889
- https://access.redhat.com/errata/RHSA-2024:8824
- https://access.redhat.com/errata/RHSA-2024:8823
- https://access.redhat.com/errata/RHSA-2024:8826
- https://bugzilla.redhat.com/show_bug.cgi?id=2311641
Frequently Asked Questions
What is the severity of REDHAT-BUG-2311641?
The severity of REDHAT-BUG-2311641 is high due to the potential for unauthorized actions resulting from exploited signature validation bypass.
How do I fix REDHAT-BUG-2311641?
To fix REDHAT-BUG-2311641, update to the latest patched version of Red Hat Keycloak as provided in the official advisories.
What are the risks associated with REDHAT-BUG-2311641?
The risks associated with REDHAT-BUG-2311641 include allowing attackers to bypass signature validation and conduct unauthorized operations.
Who is affected by REDHAT-BUG-2311641?
REDHAT-BUG-2311641 affects users of Red Hat Keycloak who rely on SAML for authentication.
When was REDHAT-BUG-2311641 reported?
REDHAT-BUG-2311641 was reported recently and has been addressed in the latest security advisories from Red Hat.
- agent/severity
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-8698
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat build of keycloak