Red Hat Security Advisory: security update of rh-sso-7/sso75 container images
🔗 CVE IDs covered (1)
📋 Description
CVE-2021-4133 — Keycloak: Incorrect authorization allows unpriviledged users to create other users
🎯 Affected products3
- Middleware Containers for OpenShift
- rh-sso-7/sso7-rhel8-operator-bundle@sha256:9614b8eff9db947fc8677fe77a7b1b658373940b5df9bb38405e0384cc8032d1_amd64 as a component of Middleware Containers for OpenShift
- rh-sso-7/sso75-openshift-rhel8@sha256:a0873a1e57be284856e6c36af2eeb4dae5f22aa2bf67e055836a77606b979cdb_amd64 as a component of Middleware Containers for OpenShift
✅ Remediation
The RHEL-8 based Middleware Containers container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References). Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally. Workaround: Access to the user-creation functionality in the REST endpoint can be deactivated using CLI commands in undertow. run: bin/jboss-cli.sh --connect /subsystem=undertow/configuration=filter/expression-filter=keycloakPathOverrideUsersCreateEndpoint:add( \ expression="(regex('^/auth/admin/realms/(.*)/users$') and method(POST))-> response-code(400)" \ ) /subsystem=undertow/server=default-server/host=default-host/filter-ref=keycloakPathOverrideUsersCreateEndpoint:add()