RHSA-2024:6497MediumCVSS 7.1

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 for OpenShift image enhancement update

Published
September 9, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (3)

CVE-2024-4629 →CVE-2024-5967 →CVE-2024-7341 →

📋 Description

CVE-2024-4629 — keycloak: potential bypass of brute force protection CVE-2024-5967 — keycloak: Leak of configured LDAP bind credentials through the Keycloak admin console CVE-2024-7341 — wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

🎯 Affected products4

  • Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:40c47f9cae2331f55c1528a7df659f4d06834eb1e1a35ff9fe70a8646f4b2b42_ppc64le as a component of Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:d55d98c3e4258b1423420db9901b498535661aa3a09e8be4eb47250e400df8a6_amd64 as a component of Middleware Containers for OpenShift
  • rh-sso-7/sso76-openshift-rhel8@sha256:d6ee9ecf6b34e8981017dd1f8b51e6e3e6ccdfcf689835180c97eae9f28ba1ad_s390x as a component of Middleware Containers for OpenShift

✅ Remediation

To update to the latest Red Hat Single Sign-On 7.6.10 for OpenShift image, Follow these steps to pull in the content: 1. On your main hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global "openshift" project. For example: $ oc login -u system:admin 2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the "openshift" project by running the following commands: $ for resource in sso76-image-stream.json \ sso76-https.json \ sso76-mysql.json \ sso76-mysql-persistent.json \ sso76-postgresql.json \ sso76-postgresql-persistent.json \ sso76-x509-https.json \ sso76-x509-mysql-persistent.json \ sso76-x509-postgresql-persistent.json do oc replace -n openshift --force -f \ https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.10.GA/templates/${resource} done 3. Install the Red Hat Single Sign-On 7.6.10 for OpenShift streams in the "openshift" project by running the following commands: $ oc -n openshift import-image redhat-sso76-openshift:1.0 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)