2 lines
16 KiB
JSON
2 lines
16 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://github.com/keycloak/keycloak","defaultStatus":"unaffected","packageName":"keycloak","versions":[{"lessThan":"22.0.10","status":"affected","version":"21.1.0","versionType":"semver"},{"lessThan":"24.0.3","status":"affected","version":"23.0.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"],"defaultStatus":"affected","packageName":"mtr/mtr-operator-bundle","product":"Migration Toolkit for Runtimes 1 on RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.2-23","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"],"defaultStatus":"affected","packageName":"mtr/mtr-rhel8-operator","product":"Migration Toolkit for Runtimes 1 on RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.2-15","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"],"defaultStatus":"affected","packageName":"mtr/mtr-web-container-rhel8","product":"Migration Toolkit for Runtimes 1 on RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.2-16","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8"],"defaultStatus":"affected","packageName":"mtr/mtr-web-executor-container-rhel8","product":"Migration Toolkit for Runtimes 1 on RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.2-14","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:migration_toolkit_applications:6.2::el8","cpe:/a:redhat:migration_toolkit_applications:6.2::el9"],"defaultStatus":"affected","packageName":"mta/mta-windup-addon-rhel9","product":"MTA-6.2-RHEL-9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"6.2.3-2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:amq_broker:7.10"],"defaultStatus":"unaffected","product":"Red Hat AMQ Broker 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:amq_broker:7.11"],"defaultStatus":"unaffected","packageName":"keycloak","product":"Red Hat AMQ Broker 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:amq_broker:7.12"],"defaultStatus":"unaffected","product":"Red Hat AMQ Broker 7","vendor":"Red Hat"},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:22::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"22.0.10-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:22::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"22-13","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:22::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"22-16","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:22"],"defaultStatus":"unaffected","packageName":"keycloak","product":"Red Hat build of Keycloak 22.0.10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 7","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.13-1.redhat_00001.1.el7sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.13-1.redhat_00001.1.el8sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.13-1.redhat_00001.1.el9sso","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhosemc:1.0::el8"],"defaultStatus":"affected","packageName":"rh-sso-7/sso76-openshift-rhel8","product":"RHEL-8 based Middleware Containers","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"7.6-46","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"defaultStatus":"unaffected","packageName":"rh-sso7-keycloak","product":"RHSSO 7.6.8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_registry:2"],"defaultStatus":"affected","packageName":"keycloak","product":"Red Hat build of Apicurio Registry 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:2"],"defaultStatus":"affected","packageName":"keycloak-core","product":"Red Hat build of Quarkus","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3"],"defaultStatus":"affected","packageName":"keycloak-core","product":"Red Hat build of Quarkus","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"unaffected","packageName":"org.wildfly.security-wildfly-elytron-parent","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_brms_platform:7"],"defaultStatus":"unknown","packageName":"keycloak","product":"Red Hat Decision Manager 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"affected","packageName":"keycloak","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_data_grid:7"],"defaultStatus":"unaffected","packageName":"keycloak","product":"Red Hat JBoss Data Grid 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"defaultStatus":"unknown","packageName":"keycloak","product":"Red Hat JBoss Enterprise Application Platform 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unaffected","packageName":"keycloak-core","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_bpms:7"],"defaultStatus":"affected","packageName":"keycloak","product":"Red Hat Process Automation 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*","matchCriteriaId":"1830E455-7E11-4264-862D-05971A42D4A6","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*","matchCriteriaId":"A0FED4EE-0AE2-4BD8-8DAC-143382E4DB7C","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*","matchCriteriaId":"CA401385-9C98-42B9-8FEC-4863201682F9","versionEndExcluding":"22.0.10","versionStartIncluding":"21.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*","matchCriteriaId":"6392BA3C-DA57-4640-BB46-C11E9EC3DAED","versionEndExcluding":"24.0.3","versionStartIncluding":"23.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:migration_toolkit_for_applications:1.0:*:*:*:*:*:*:*","matchCriteriaId":"99552EC4-6484-4274-B2CC-45EEFB1D2506","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:migration_toolkit_for_runtimes:-:*:*:*:*:*:*:*","matchCriteriaId":"F979A5E3-7FFB-45F1-9847-FFBAF0B12067","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*","matchCriteriaId":"EA983F8C-3A06-450A-AEFF-9429DE9A3454","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*","matchCriteriaId":"40449571-22F8-44FA-B57B-B43F71AB25E2","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:*","matchCriteriaId":"01B0F191-ADDB-4AAE-A5C5-5CC16909E64A","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*","matchCriteriaId":"FD75BCB4-F0E1-4C05-A2D7-001503C805C9","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*","matchCriteriaId":"B02036DD-4489-480B-B7D4-4EB08952377B","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*","matchCriteriaId":"C7E78C55-45B6-4E01-9773-D3468F8EA9C3","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*","matchCriteriaId":"30E2CF79-2D56-48AB-952E-5DDAFE471073","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*","matchCriteriaId":"54E24055-813B-4E6D-94B7-FAD5F78B8537","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*","matchCriteriaId":"341E6313-20D5-44CB-9719-B20585DC5AD6","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*","matchCriteriaId":"2DEC61BC-E699-456E-99B6-C049F2A5F23F","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL."},{"lang":"es","value":"Se encontró una falla en Keycloak, donde no valida correctamente las URL incluidas en una redirección. Este problema podría permitir a un atacante crear una solicitud maliciosa para eludir la validación y acceder a otras URL e información confidencial dentro del dominio o realizar más ataques. Esta falla afecta a cualquier cliente que utilice un comodín en el campo URI de redireccionamiento válido y requiere la interacción del usuario dentro de la URL maliciosa."}],"id":"CVE-2024-1132","lastModified":"2026-11-04T21:17:35.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-1132","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-04-23T18:37:10.567431Z","version":"2.0.3"}}]},"published":"2024-04-17T14:15:07.953","references":[{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1860"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1861"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1862"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1864"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1866"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1867"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1868"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:2945"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3752"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3762"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3919"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3989"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2024-1132"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262117"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1860"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1861"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1862"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1864"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1866"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1867"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:1868"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:2945"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3752"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3762"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3919"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:3989"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2024-1132"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262117"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|