CVE-2024-4540
Fixed in a distro release EPSS <1%CVSS 7.5
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 22, Red Hat build of Keycloak 24, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat RHEL-8 based Middleware Containers
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 24.0.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-bitnami-fips | 25.0.0-r0 |
| Chainguard | keycloak-fips | 25.0.0-r0 |
| Chainguard | keycloak-fips-bitnami-compat | 25.0.0-r0 |
| Chainguard | keycloak-fips-policy-140-2 | 25.0.0-r0 |
| Chainguard | keycloak-fips-policy-140-3 | 25.0.0-r0 |
| Chainguard | keycloak-iamguarded-fips | 25.0.0-r0 |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.14-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.14-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.14-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.14-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.14-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.14-1.redhat_00001.1.el9sso |