Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2618
Moderate: rh-sso7-keycloak security update
19 October 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rh-sso7-keycloak
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Server 7
Impact/Access: Cross-site Request Forgery -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-12197 CVE-2017-12160 CVE-2017-12159
CVE-2017-12158
Reference: ESB-2017.2615
Original Bulletin:
https://access.redhat.com/errata/RHSA-2017:2904
https://access.redhat.com/errata/RHSA-2017:2905
Comment: This bulletin contains two (2) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: rh-sso7-keycloak security update
Advisory ID: RHSA-2017:2904-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2904
Issue date: 2017-10-17
CVE Names: CVE-2017-12158 CVE-2017-12159 CVE-2017-12160
CVE-2017-12197
=====================================================================
1. Summary:
An update for rh-sso7-keycloak is now available for Red Hat Single Sign-On
7.1 for RHEL 6.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Single Sign-On 7.1 for RHEL 6 Server - noarch
3. Description:
Red Hat Single Sign-On is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.1.3 serves as a replacement for
Red Hat Single Sign-On 7.1.2, and includes several bug fixes and
enhancements. For further information, refer to the Release Notes linked to
in the References section.
Security Fix(es):
* It was found that keycloak would accept a HOST header URL in the admin
console and use it to determine web resource locations. An attacker could
use this flaw against an authenticated user to attain reflected XSS via a
malicious server. (CVE-2017-12158)
* It was found that the cookie used for CSRF prevention in Keycloak was not
unique to each session. An attacker could use this flaw to gain access to
an authenticated user session, leading to possible information disclosure
or further attacks. (CVE-2017-12159)
* It was found that libpam4j did not properly validate user accounts when
authenticating. A user with a valid password for a disabled account would
be able to bypass security restrictions and possibly access sensitive
information. (CVE-2017-12197)
* It was found that Keycloak oauth would permit an authenticated resource
to obtain an access/refresh token pair from the authentication server,
permitting indefinite usage in the case of permission revocation. An
attacker on an already compromised resource could use this flaw to grant
himself continued permissions and possibly conduct further attacks.
(CVE-2017-12160)
Red Hat would like to thank Mykhailo Stadnyk (Playtech) for reporting
CVE-2017-12158; Prapti Mittal for reporting CVE-2017-12159; and Bart
Toersche (Simacan) for reporting CVE-2017-12160. The CVE-2017-12197 issue
was discovered by Christian Heimes (Red Hat).
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1484111 - CVE-2017-12159 keycloak: CSRF token fixation
1484154 - CVE-2017-12160 keycloak: resource privilege extension via access token in oauth
1489161 - CVE-2017-12158 keycloak: reflected XSS using HOST header
1503103 - CVE-2017-12197 libpam4j: Account check bypass
6. JIRA issues fixed (https://issues.jboss.org/):
RHSSO-1121 - Tracker bug for the RH-SSO 7.1.3 release for RHEL-6
7. Package List:
Red Hat Single Sign-On 7.1 for RHEL 6 Server:
Source:
rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el6.src.rpm
noarch:
rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el6.noarch.rpm
rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el6.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
8. References:
https://access.redhat.com/security/cve/CVE-2017-12158
https://access.redhat.com/security/cve/CVE-2017-12159
https://access.redhat.com/security/cve/CVE-2017-12160
https://access.redhat.com/security/cve/CVE-2017-12197
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.1/html/release_notes/
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZ5l/LXlSAg2UNWIIRAjd4AKChrVPZR4vTY/tr5a4OgWHJ9Of1twCgwcbz
S9TXe2J0AdA/dPisYuukI/Y=
=cg1S
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: rh-sso7-keycloak security update
Advisory ID: RHSA-2017:2905-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2905
Issue date: 2017-10-17
CVE Names: CVE-2017-12158 CVE-2017-12159 CVE-2017-12160
CVE-2017-12197
=====================================================================
1. Summary:
An update for rh-sso7-keycloak is now available for Red Hat Single Sign-On
7.1 for RHEL 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Single Sign-On 7.1 for RHEL 7 Server - noarch
3. Description:
Red Hat Single Sign-On is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.1.3 serves as a replacement for
Red Hat Single Sign-On 7.1.2, and includes several bug fixes and
enhancements. For further information, refer to the Release Notes linked to
in the References section.
Security Fix(es):
* It was found that keycloak would accept a HOST header URL in the admin
console and use it to determine web resource locations. An attacker could
use this flaw against an authenticated user to attain reflected XSS via a
malicious server. (CVE-2017-12158)
* It was found that the cookie used for CSRF prevention in Keycloak was not
unique to each session. An attacker could use this flaw to gain access to
an authenticated user session, leading to possible information disclosure
or further attacks. (CVE-2017-12159)
* It was found that libpam4j did not properly validate user accounts when
authenticating. A user with a valid password for a disabled account would
be able to bypass security restrictions and possibly access sensitive
information. (CVE-2017-12197)
* It was found that Keycloak oauth would permit an authenticated resource
to obtain an access/refresh token pair from the authentication server,
permitting indefinite usage in the case of permission revocation. An
attacker on an already compromised resource could use this flaw to grant
himself continued permissions and possibly conduct further attacks.
(CVE-2017-12160)
Red Hat would like to thank Mykhailo Stadnyk (Playtech) for reporting
CVE-2017-12158; Prapti Mittal for reporting CVE-2017-12159; and Bart
Toersche (Simacan) for reporting CVE-2017-12160. The CVE-2017-12197 issue
was discovered by Christian Heimes (Red Hat).
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1484111 - CVE-2017-12159 keycloak: CSRF token fixation
1484154 - CVE-2017-12160 keycloak: resource privilege extension via access token in oauth
1489161 - CVE-2017-12158 keycloak: reflected XSS using HOST header
1503103 - CVE-2017-12197 libpam4j: Account check bypass
6. JIRA issues fixed (https://issues.jboss.org/):
RHSSO-1122 - Tracker bug for the RH-SSO 7.1.3 release for RHEL-7
7. Package List:
Red Hat Single Sign-On 7.1 for RHEL 7 Server:
Source:
rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7.src.rpm
noarch:
rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7.noarch.rpm
rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
8. References:
https://access.redhat.com/security/cve/CVE-2017-12158
https://access.redhat.com/security/cve/CVE-2017-12159
https://access.redhat.com/security/cve/CVE-2017-12160
https://access.redhat.com/security/cve/CVE-2017-12197
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.1/html/release_notes/
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZ5mAGXlSAg2UNWIIRAieAAJ97xK8oXjWHhinik9vA5wl1vjHEKwCgsVT5
PjVXchgkKjetG+DUUT080XM=
=IlGm
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWefoB4x+lLeg9Ub1AQgLWRAAiQChRtEb5OAN/3ZlEp1/4ES8KgYapKei
k+e5ok87I8dyv40uPbNR2QeGCUxwbCdZUeGYquu4vc99NKIy+7ndKqlZSeODbVGA
EAy9x/J/UhmfciBJdZQt/K9AxeMXWDN6ByTqmDvXZYFP6EyLmhbBdG1vJj17IUmK
S6ATIY3MPFM0Q0xscFLkUBIuIDtnQMTO1S2i5FDQd5MHXvq1o48weJZfJ8/Q5qxn
XJNfmu1S+CEviBgQ3MZwJvJy8F02V9z37PTc3FBANBhZAyfGmZLt6tkBY0MSvgaI
09uxv2/0JcwHC9LE3TI8FmHb0nb9b3fhyCSrx/BO1RnoJOXPxBVnZv2e0hk4tiXP
IoCTM7u3xtuO/9APO5j8gCmcx7Hbia0PRkk4CouCCakbkLNPYyKznuIMpL155xtM
jIG9bw8VO+5I6lieU/NRTZ12kDA8SecqFLnUY97GtsUJfYEIiLQH/k3eHdn1rmpM
28oe7XyH0HXapkZsh1BiRzkI2W1eztlIfYpdZKwoRwIaCqoD0nf3IkPXozChXX9/
liX7yWc78dc0aQgrnLPtoLVpCorIZHaxaZvOq4E/55VRQGMSDfOJuwZkXHdI5qoE
TqLK8mR8p2wA7EtyGI9/uW+9VZiX2kgLixXBGWU8rNo9G/9tc8GxNn/5xkA8W2Pt
yuaabJVwfec=
=RwaU
-----END PGP SIGNATURE-----