Red Hat OpenShift Container Platform 4.12

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

Keycloak: path transversal in redirection validation

Quarkus: http security policy bypass

Cri-o: malicious container can create symlink on host

Keycloak: client access via device auth request spoof

Kube-apiserver: privesc

Keycloak: offline session token dos

Glib: integer overflow in in g_escape_uri_string()

Rsync: info leak via uninitialized stack contents

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

Undertow: outofmemoryerror due to @multipartconfig handling

Undertow: infinite loop in sslconduit during close

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Openshift: modification of node role labels

Keycloak: redirect_uri validation bypass

Keycloak: oauth client impersonation

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

Keycloak: potential bypass of brute force protection

Keycloak: vulnerable redirect uri validation results in open redirec

Operator: plaintext password in operator log

Operator: passwords defined in secrets shown in statefulset yaml

Keycloak: reflected xss via wildcard in oidc redirect_uri

Cri-o: security regression of cve-2022-27652