Red Hat Red Hat Single Sign-On 7.6 for RHEL 9
26 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-7507 | | Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover | HIGH 7.5 | 0.8 % | ||
| CVE-2026-7307 | | Keycloak: keycloak: denial of service via specially crafted saml input | HIGH 7.5 | 0.9 % | ||
| CVE-2026-4634 | | Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters | HIGH 7.5 | 0.6 % | ||
| CVE-2026-2575 | | Keycloak: keycloak: denial of service due to excessive samlrequest decompression | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-2092 | | Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions | HIGH 7.7 | 0.4 % | ||
| CVE-2026-0603 | | Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection | HIGH 8.3 | 1.0 % | ||
| CVE-2024-7341 | | Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters | HIGH 7.1 | 0.8 % | ||
| CVE-2024-4629 | | Keycloak: potential bypass of brute force protection | MEDIUM 6.5 | 0.8 % | ||
| CVE-2024-5967 | | Keycloak: leak of configured ldap bind credentials through the keycloak admin console | LOW 2.7 | 0.6 % | ||
| CVE-2024-4540 | | Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie | HIGH 7.5 | 0.6 % | ||
| CVE-2023-6544 | | Keycloak: authorization bypass | MEDIUM 5.4 | 1.1 % | ||
| CVE-2023-6484 | | Keycloak: log injection during webauthn authentication or registration | MEDIUM 5.3 | 1.0 % | ||
| CVE-2024-1249 | | Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos | HIGH 7.4 | 0.4 % | ||
| CVE-2024-1132 | | Keycloak: path transversal in redirection validation | HIGH 8.1 | 1.6 % | ||
| CVE-2024-1635 | | Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol | HIGH 7.5 | 4.6 % | ||
| CVE-2023-6291 | | Keycloak: redirect_uri validation bypass | HIGH 7.1 | 0.9 % | ||
| CVE-2023-2585 | corrigé en 0:18.0.8-1.redhat_00001.1.el9sso | Keycloak: client access via device auth request spoof | HIGH 8.1 | 0.7 % | ||
| CVE-2023-6927 | | Keycloak: open redirect via "form_post.jwt" jarm response mode | MEDIUM 6.1 | 1.1 % | ||
| CVE-2023-6134 | | Keycloak: reflected xss via wildcard in oidc redirect_uri | MEDIUM 5.4 | 1.3 % | ||
| CVE-2023-6563 | corrigé en 0:18.0.11-2.redhat_00003.1.el9sso | Keycloak: offline session token dos | HIGH 7.7 | 1.2 % | ||
| CVE-2023-2422 | corrigé en 0:18.0.8-1.redhat_00001.1.el9sso | Keycloak: oauth client impersonation | HIGH 7.1 | 0.5 % | ||
| CVE-2023-3223 | | Undertow: outofmemoryerror due to @multipartconfig handling | HIGH 7.5 | 2.7 % | ||
| CVE-2022-4137 | corrigé en 0:18.0.6-1.redhat_00001.1.el9sso | Keycloak: reflected xss attack | HIGH 8.1 | 1.2 % | ||
| CVE-2022-3916 | | Keycloak: session takeover with oidc offline refreshtokens | MEDIUM 6.8 | 1.0 % | ||
| CVE-2022-1438 | corrigé en 0:18.0.6-1.redhat_00001.1.el9sso | Keycloak: xss on impersonation under specific circumstances | MEDIUM 6.4 | 0.7 % | ||
| CVE-2023-1108 | | Undertow: infinite loop in sslconduit during close | HIGH 7.5 | 1.8 % |