CVE-2022-0225
Fixed in a distro release EPSS 3%
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
Products: redhat keycloak, redhat single_sign-on
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-core | 20.0.0 |
| Maven | org.keycloak:keycloak-core | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.8-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.8-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.8-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.8-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7 | 0:1-5.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-javapackages-filesystem | 0:6.0.0-7.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-javapackages-tools | 0:6.0.0-7.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-python3-javapackages | 0:6.0.0-7.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-runtime | 0:1-5.el9sso |