RHSA-2023:7857HighCVSS 7.7

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 for OpenShift image enhancement and security update

Published
December 14, 2023
Last Modified
August 4, 2026

🔗 CVE IDs covered (3)

CVE-2023-6134 →CVE-2023-6291 →CVE-2023-6563 →

📋 Description

CVE-2023-6134 — keycloak: reflected XSS via wildcard in OIDC redirect_uri CVE-2023-6291 — keycloak: redirect_uri validation bypass CVE-2023-6563 — keycloak: offline session token DoS

🎯 Affected products5

  • Middleware Containers for OpenShift
  • rh-sso-7/sso7-rhel8-operator-bundle@sha256:4cbf1a09c7207f9f1ffc918b5e8a4adaa89938befc6d75040b3ddd505ab14f6c_amd64 as a component of Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:05c8f187d183582102855c12ac856f361cc6a0bbd792675799bfc319694bc662_s390x as a component of Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:c65934aa7883ccd9655cd1e7e47899e97470e42cc32bbe5386cc64f88fd26696_ppc64le as a component of Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:db235506ce5d840dc139a3cde4114939222df6abb0901efaaff4f9ddbc495b9b_amd64 as a component of Middleware Containers for OpenShift

✅ Remediation

To update to the latest Red Hat Single Sign-On 7.6.6 for OpenShift image, follow these steps to pull in the content: 1. On your main hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global "openshift" project. For example: $ oc login -u system:admin 2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the "openshift" project by running the following commands: $ for resource in sso76-image-stream.json \ sso76-https.json \ sso76-mysql.json \ sso76-mysql-persistent.json \ sso76-postgresql.json \ sso76-postgresql-persistent.json \ sso76-x509-https.json \ sso76-x509-mysql-persistent.json \ sso76-x509-postgresql-persistent.json do oc replace -n openshift --force -f \ https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.6.GA/templates/${resource} done 3. Install the Red Hat Single Sign-On 7.6.6 for OpenShift streams in the "openshift" project by running the following command: $ oc -n openshift import-image redhat-sso76-openshift:1.0 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: There are three main options to prevent exploitation: 1) If you are using a reverse proxy, block the consents URL. 2) This option is less effective: remove the consents application tab from the account console theme. 3) This option has a significant negative impact on end users: entirely disable offline user profiles.

🔗 References (6)