CVE-2022-3916
Fixed in a distro release EPSS <1%CVSS 6.8
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
Products: Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6.1, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat RHEL-8 based Middleware Containers
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-parent | 20.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00002.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00002.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.3-1.redhat_00002.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.6-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.6-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.6-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00002.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00002.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.3-1.redhat_00002.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.6-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.6-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.6-1.redhat_00001.1.el9sso |