Red Hat OpenShift Container Platform

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

Rhsso-container-image: unsecured management interface exposed to adjecent network

Keycloak: path transversal in redirection validation

Keycloak: client access via device auth request spoof

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Cri-o: /etc/passwd tampering privesc

Keycloak: offline session token dos

Glib: integer overflow in in g_escape_uri_string()

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

Undertow: outofmemoryerror due to @multipartconfig handling

Undertow: infinite loop in sslconduit during close

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Python-eventlet: patch regression for cve-2021-21419 in some red hat builds

Ocp & fips mode

Keycloak: redirect_uri validation bypass

Keycloak: session takeover with oidc offline refreshtokens

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

Keycloak: potential bypass of brute force protection

Kubevirt-csi: persistentvolume allows access to hcp's root node

Keycloak: vulnerable redirect uri validation results in open redirec

Keycloak: reflected xss via wildcard in oidc redirect_uri