A vulnerability was found in 3Scale when using with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the authtype is use3scaleoidcissuerendpoint, Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO 7.5. As the result, the policy doesn't inspect tokens; it determines that all tokens are valid.

Using an alternate authtype: authtype: clientid+clientsecret. Disabling the policy entirely might be a temporary solution if the alternate {{authtype is not feasible for some reason. The only purpose the token introspection endpoint serves is for sessions which are revoked in RH SSO before the standard TTL expires via the exp claim.

Red Hat Single Sign-On is an integrated sign-on solution, available as a<br>Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat<br>Single Sign-On for OpenShift image provides an authentication server that<br>you can use to log in centrally, log out, and register. You can also manage<br>user accounts for web applications, mobile applications, and RESTful web<br>services.<br>This erratum releases a new image for Red Hat Single Sign-On 7.6.10 for<br>use within the OpenShift Container Platform 3.10, OpenShift Container Platform<br>3.11, and within the OpenShift Container Platform 4.3 cloud computing Platform-as-a-Service (PaaS) for<br>on-premise or private cloud deployments, aligning with the standalone product release.<br>Security fixes:<br><li> potential bypass of brute force protection (CVE-2024-4629)</li> <li> session fixation in elytron saml adapters (CVE-2024-7341)</li> <li> Leak of configured LDAP bind credentials through the Keycloak admin console (CVE-2024-5967)</li>

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This asynchronous patch is a security update for the Undertow package in Red Hat Single Sign-On 7.3.8. Security Fix(es): infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods (CVE-2019-10174) mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter (CVE-2018-14371) Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 (CVE-2020-6950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.1 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. The Node.js adapter provides a simple module for authentication and authorization in Node.js applications.This asynchronous patch is a security update for the Node.js adapter for Red Hat Single Sign-On 7.1.Security Fix(es): It was found that the Keycloak Node.js adapter did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks. (CVE-2017-7474) Red Hat would like to thank Nick Shearer (Quest) for reporting this issue.

Red Hat Single Sign-On 7.2 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.2.2 serves as a replacement for Red Hat Single Sign-On 7.2.1, and includes several bug fixes and enhancements. For further information, refer to the Release Notes linked to in the References section.Security Fix(es): slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Red Hat would like to thank Chris McCown for reporting this issue.

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.3.2 serves as a replacement for Red Hat Single Sign-On 7.3.1, and includes bug fixes and enhancements, which are documented in the Release Notes document.<br>Security Fix(es):<br><li> bootstrap: XSS in the data-target attribute (CVE-2016-10735)</li> <li> bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)</li> <li> bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676)</li> <li> bootstrap: XSS in the affix configuration target property (CVE-2018-20677)</li> <li> picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872)</li> <li> picketlink: URL injection via xinclude parameter (CVE-2019-3873)</li> <li> keycloak: X.509 authentication: CRL signatures are not verified (CVE-2019-3875)</li> <li> undertow: leak credentials to log files UndertowLogger.REQUESTLOGGER.undertowRequestFailed (CVE-2019-3888)</li> <li> bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)</li> <li> keycloak: Node.js adapter internal NBF can be manipulated (CVE-2019-10157)</li> <li> js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection (CVE-2019-11358)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.5.3 serves as a replacement for Red Hat Single Sign-On 7.5.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)</li> <li> h2: Remote Code Execution in Console (CVE-2021-42392)</li> <li> netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)</li> <li> xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)</li> <li> keycloak: Stored XSS in groups dropdown (CVE-2022-0225)</li> <li> wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled (CVE-2022-0866)</li> <li> keycloak-saml-core: keycloak: Uploading of SAML javascript protocol mapper scripts through the admin (CVE-2022-2668)</li> <li> keycloak-core: keycloak: improper input validation permits script injection (CVE-2022-2256)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.6.3 serves as a replacement for Red Hat Single Sign-On 7.6.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> ok<a href="http:" target="blank">http:</a> information disclosure via improperly used cryptographic function (CVE-2021-0341)</li> <li> undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)</li> <li> snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)</li> <li> dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)</li> <li> codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)</li> <li> apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider (CVE-2022-45787)</li> <li> RESTEasy: creation of insecure temp files (CVE-2023-0482)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.1 serves as a replacement for Red Hat Single Sign-On 7.0, and includes several bug fixes and enhancements. For further information, refer to the Release Notes linked to in the References section.<br>Security Fix(es):<br><li> It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the REST server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm. (CVE-2016-8629)</li> <li> It was found that JBoss EAP 7 Header Cache was inefficient. An attacker could use this flaw to cause a denial of service attack. (CVE-2016-9589)</li> <li> It was found that keycloak's implementation of HMAC verification for JWS tokens uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. (CVE-2017-2585)</li> Red Hat would like to thank Gabriel Lavoie (Halogen Software) for reporting CVE-2016-9589 and Richard Kettelerij (Mindloops) for reporting CVE-2017-2585.

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 7.2.Security Fix(es): keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Middleware for OpenShift provides images for many of the Red Hat Middleware products, for use with OpenShift Container Platform, with on-premise or private cloud deployments.This errata updates the following images by applying a fix for CVE-2017-5645 (https://access.redhat.com/security/cve/CVE-2017-5645): Red Hat JBoss Enterprise Application Platform 6.4, Red Hat JBoss Enterprise Application Platform 7.0, Red Hat JBoss Web Server 3.0, Red Hat JBoss Web Server 3.1, Red Hat JBoss Data Grid 6.5, Red Hat JBoss BPM Suite 6.3 Process Server, Red Hat JBoss BPM Suite 6.4 Process Server, Red Hat JBoss BRMS 6.3 Decision Server, Red Hat JBoss BRMS 6.4 Decision Server, and Red Hat Single Sign-On 7.0.

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.3.3 serves as a replacement for Red Hat Single Sign-On 7.3.2, and includes bug fixes and enhancements, which are documented in the Release Notes, linked to in the References section.<br>Security Fix(es):<br><li> keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)</li> <li> keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.3.5 serves as a replacement for Red Hat Single Sign-On 7.2.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> keycloak: Service accounts reset password flow not using placeholder.org domain anymore (CVE-2019-14837)</li> <li> undertow: HTTP/2: flood using PING frames results in unbounded memory growth</li> (CVE-2019-9512)<br><li> undertow: HTTP/2: flood using HEADERS frames results in unbounded memory</li> growth (CVE-2019-9514)<br><li> undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory</li> growth (CVE-2019-9515)<br><li> wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer'</li> user by default (CVE-2019-14838)<br><li> wildfly: wildfly-security-manager: security manager authorization bypass</li> (CVE-2019-14843)<br>For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.4.10 serves as a replacement for Red Hat Single Sign-On 7.4.9, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)</li> <li> wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)</li> <li> wildfly: incorrect JBOSSLOCALUSER challenge location may lead to giving access to all the local users (CVE-2021-3717)</li> <li> jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)</li> <li> xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)</li> <li> resteasy: Error message exposes endpoint class information (CVE-2021-20289)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.2 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.2.6 serves as a replacement for Red Hat Single Sign-On 7.2.5, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer (CVE-2018-14642)</li> <li> console: wildfly-core: Cross-site scripting (XSS) in JBoss Management Console (CVE-2018-10934)</li> <li> dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents (CVE-2018-1000632)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Packages: Red Hat Single Sign-On 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6Security Fix(es): keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714) For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.

The rh-sso-7/sso76-openshift-rhel8 container image and rh-sso-7/sso7-rhel8-operator operator has been updated for RHEL-8 based Middleware Containers to address the following security issues.<br>Security Fix(es):<br><li> keycloak: path traversal via double URL encoding (CVE-2022-3782)</li> <li> keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Users of rh-sso-7/sso76-openshift-rhel8 container images and rh-sso-7/sso7-rhel8-operator operator are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.<br>You can find images updated by this advisory in Red Hat Container Catalog (see References).

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.6.1 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes the following security fixes.<br>Security Fix(es):<br><li> keycloak: path traversal via double URL encoding (CVE-2022-3782)</li> <li> keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This asynchronous patch is a security update for the Undertow package in Red Hat Single Sign-On 7.3.7. Security Fix(es): undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>Security Fix:<br><li> hibernate-core: SQL injection vulnerability when both hibernate.usesqlcomments and JPQL String literals are used (CVE-2020-25638)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This is an asynchronous patch for Red Hat Single Sign-On 7.5, and includes one security fix.Security Fix: keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.5.2 serves as a replacement for Red Hat Single Sign-On 7.5.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.Security Fix(es): log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.5 container images for IBM P/Z, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This is a security update Red Hat Single Sign-On 7.5, and includes one security fix.Security Fix: keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.4.8 serves as a replacement for Red Hat Single Sign-On 7.4.7, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.Security Fix(es): netty: Request smuggling via content-length header (CVE-2021-21409) wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.4.10 serves as a replacement for Red Hat Single Sign-On 7.4.9, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.Security Fix(es): undertow: client side invocation timeout raised when calling over HTTP and HTTP2 (CVE-2021-3859)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.5.1 serves as a replacement for Red Hat Single Sign-On 7.5.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.Security Fix(es): undertow: client side invocation timeout raised when calling over HTTP and HTTP2 (CVE-2021-3859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.