open redirect via "form_post.jwt" JARM response mode
CVE: CVE-2023-6927
Component: keycloak
CWE: CWE-601
Severity: Moderate
CVSS v3: 4.8/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2023-12-18T00:00:00+00:00

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.

Statement: Red Hat rates this as a moderate, following the same case for CVE-2023-6134, but with another response mode with JSON Web Token.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To update to the latest Red Hat Single Sign-On 7.6.7 for OpenShift
image, Follow these steps to pull in the content:

1. On your main hosts, ensure you are logged into the CLI as a
cluster administrator or user with project administrator access
to the global "openshift" project. For example:

$ oc login -u system:admin

2. Update the core set of Red Hat Single Sign-On resources for OpenShift
in the "openshift" project by running the following commands:

$ for resource in sso76-image-stream.json \
sso76-https.json \
sso76-mysql.json \
sso76-mysql-persistent.json \
sso76-postgresql.json \
sso76-postgresql-persistent.json \
sso76-x509-https.json \
sso76-x509-mysql-persistent.json \
sso76-x509-postgresql-persistent.json
do
oc replace -n openshift --force -f \
https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.7.GA/templates/${resource}
done

3. Install the Red Hat Single Sign-On 7.6.7 for OpenShift streams in the
"openshift" project by running the following commands:

$ oc -n openshift import-image redhat-sso76-openshift:1.0
To update to the latest Red Hat Single Sign-On 7.6.6 for OpenShift image, follow these steps to pull in the content:

1. On your main hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global "openshift" project. For example:

$ oc login -u system:admin

2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the "openshift" project by running the following commands:

$ for resource in sso76-image-stream.json \
sso76-https.json \
sso76-mysql.json \
sso76-mysql-persistent.json \
sso76-postgresql.json \
sso76-postgresql-persistent.json \
sso76-x509-https.json \
sso76-x509-mysql-persistent.json \
sso76-x509-postgresql-persistent.json
do
oc replace -n openshift --force -f \
https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.6.6.GA/templates/${resource}
done

3. Install the Red Hat Single Sign-On 7.6.6 for OpenShift streams in the "openshift" project by running the following command:

$ oc -n openshift import-image redhat-sso76-openshift:1.0
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

For more details see:
https://access.redhat.com/documentation/en-us/red_hat_build_of_keycloak/22.0/html-single/migration_guide/
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.