A flaw was found in Keycloaks OIDC component in the checkLoginIframe, which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applications availability without proper origin validation for incoming messages.
The product does not properly verify that the source of data or communication is valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat AMQ Broker 7 | RedHat | keycloak | * |
| Red Hat build of Keycloak 22 | RedHat | rhbk/keycloak-operator-bundle:22.0.10-1 | * |
| Red Hat build of Keycloak 22 | RedHat | rhbk/keycloak-rhel9:22-13 | * |
| Red Hat build of Keycloak 22 | RedHat | rhbk/keycloak-rhel9-operator:22-16 | * |
| Red Hat build of Keycloak 22.0.10 | RedHat | keycloak | * |
| Red Hat Single Sign-On 7.6 for RHEL 7 | RedHat | rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el7sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 8 | RedHat | rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el8sso | * |
| Red Hat Single Sign-On 7.6 for RHEL 9 | RedHat | rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el9sso | * |
| RHEL-8 based Middleware Containers | RedHat | rh-sso-7/sso76-openshift-rhel8:7.6-46 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-data-index-ephemeral-rhel8:1.33.0-5 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-data-index-postgresql-rhel8:1.33.0-5 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-jobs-service-ephemeral-rhel8:1.33.0-5 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-jobs-service-postgresql-rhel8:1.33.0-5 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8:1.33.0-5 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-operator-bundle:1.33.0-5 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-rhel8-operator:1.33.0-3 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-swf-builder-rhel8:1.33.0-5 | * |
| RHOSS-1.33-RHEL-8 | RedHat | openshift-serverless-1/logic-swf-devmode-rhel8:1.33.0-5 | * |
| RHSSO 7.6.8 | RedHat | keycloak | * |