Issued:

2024-11-21

Updated:

2024-11-21

RHSA-2024:10178 - Important: Red Hat build of Keycloak 26.0.6 Update

Synopsis

Important: Red Hat build of Keycloak 26.0.6 Update

Type/Severity

Security Advisory Important

Topic

New Red Hat build of Keycloak 26.0.6 packages with security impact Important are available from the Customer Portal

Description

Red Hat build of Keycloak 26.0.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:

• Sensitive Data Exposure in Keycloak Build Process (CVE-2024-10451)
• Keycloak Denial of Service (CVE-2024-10270)
• Keycloak path trasversal (CVE-2024-10492)
• Keycloak proxy header handling Denial-of-Service (DoS) vulnerability (CVE-2024-9666)
• Keycloak TLS passthrough (CVE-2024-10039)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Fixes

• This content is not included.BZ - 2317440
• This content is not included.BZ - 2319217
• This content is not included.BZ - 2321214
• This content is not included.BZ - 2322096
• This content is not included.BZ - 2322447

CVEs

• CVE-2024-9666
• CVE-2024-10039
• CVE-2024-10270
• CVE-2024-10451
• CVE-2024-10492

References

• https://access.redhat.com/security/updates/classification/#important

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.