- Issued:
- 2024-11-21
- Updated:
- 2024-11-21
RHSA-2024:10176 - Important: Red Hat build of Keycloak 24.0.9 Update
Synopsis
Important: Red Hat build of Keycloak 24.0.9 Update
Type/Severity
Security Advisory Important
Topic
New Red Hat build of Keycloak 24.0.9 packages with security impact Important are available from the Customer Portal
Description
Red Hat build of Keycloak 24.0.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
Security fixes:
- Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)
- Keycloak Denial of Service (CVE-2024-10270)
- Keycloak path trasversal (CVE-2024-10492)
- Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)
- Keycloak TLS passthrough (CVE-2024-10039)
Solution
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat build of Keycloak | Text-only Advisories | x86_64 |
Fixes
- This content is not included.BZ - 2317440
- This content is not included.BZ - 2319217
- This content is not included.BZ - 2321214
- This content is not included.BZ - 2322096
- This content is not included.BZ - 2322447
CVEs
References
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.