CVE-2022-2668
Fixed in a distro release EPSS 1%
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled
Products: redhat keycloak, redhat single_sign-on
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-parent | 19.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.8-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak | 0:15.0.8-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.8-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.5 | rh-sso7-keycloak-server | 0:15.0.8-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7 | 0:1-5.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-javapackages-filesystem | 0:6.0.0-7.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-javapackages-tools | 0:6.0.0-7.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-python3-javapackages | 0:6.0.0-7.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-runtime | 0:1-5.el9sso |