Public vulnerability disclosure
CVE-2024-8883
Keycloak: vulnerable redirect uri validation results in open redirec
publishedCWE-601
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Technical severity6.1 mediumCVSS 3.1 · CNA: redhat
Published2024-09-19Source updated 2026-11-03
Collected2026-11-032 attributed sources
Fixes and workarounds
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
keycloak-services
https://github.com/keycloak/keycloak |
≥ 0; < 22.0.12 (affected, semver) ≥ 23.0.0; < 24.0.7 (affected, semver) ≥ 25.0.0; < 25.0.5 (affected, semver) Other versions: unaffected |
CNA: redhat |
| Red Hat Build of Keycloak Red Hat keycloak-services
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat build of Keycloak 22 Red Hat rhbk/keycloak-operator-bundle
https://catalog.redhat.com/software/containers/ |
≥ 22.0.13-1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 22 Red Hat rhbk/keycloak-rhel9
https://catalog.redhat.com/software/containers/ |
≥ 22-18; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 22 Red Hat rhbk/keycloak-rhel9-operator
https://catalog.redhat.com/software/containers/ |
≥ 22-21; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 24 Red Hat rhbk/keycloak-operator-bundle
https://catalog.redhat.com/software/containers/ |
≥ 24.0.8-1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 24 Red Hat rhbk/keycloak-rhel9
https://catalog.redhat.com/software/containers/ |
≥ 24-17; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 24 Red Hat rhbk/keycloak-rhel9-operator
https://catalog.redhat.com/software/containers/ |
≥ 24-17; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8 Red Hat https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:800.4.1-1.GA_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.4-3.GA_redhat_00007.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-activemq-artemis
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.33.0-1.redhat_00015.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-activemq-artemis-native
https://access.redhat.com/downloads/content/package-browser/ |
≥ 1:2.0.0-2.redhat_00005.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-aesh-extensions
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.8.0-2.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-aesh-readline
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.0-2.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-apache-commons-codec
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.16.1-2.redhat_00007.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-apache-commons-collections
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.2.2-28.redhat_2.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-apache-commons-io
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.15.1-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-apache-commons-lang
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.14.0-2.redhat_00006.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-apache-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.5-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-artemis-native
https://access.redhat.com/downloads/content/package-browser/ |
≥ 1:2.0.0-2.redhat_00005.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-artemis-wildfly-integration
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.1-1.redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-asyncutil
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:0.1.0-2.redhat_00010.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-aws-java-sdk
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.12.284-2.redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-cryptacular
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.5-2.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:800.4.0-1.GA_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-fastinfoset
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.1.0-4.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-hibernate
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:6.2.31-1.Final_redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-hibernate-validator
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.1-3.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-hppc
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:0.8.1-2.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-insights-java-client
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.1.3-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-jakarta-servlet-jsp-jstl-api
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.0.1-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-jboss-cert-helper
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.1.3-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-jboss-logging
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.5.3-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-jctools
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.2-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-jgroups
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:5.3.10-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-log4j
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.22.1-1.redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-narayana
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:6.0.3-1.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-nimbus-jose-jwt
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:9.37.3-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-objectweb-asm
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:9.6.0-1.redhat_00002.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-pem-keystore
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.0-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-resteasy-extensions
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.1-3.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-resteasy-spring
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.0.1-2.Final_redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-saaj-impl
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.0.4-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-shibboleth-java-support
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.0-6.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-slf4j
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.16-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-snakeyaml
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.0-1.redhat_00001.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.4-2.GA_redhat_00005.1.el8eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:800.4.1-1.GA_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.4-3.GA_redhat_00007.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-activemq-artemis
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.33.0-1.redhat_00015.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-activemq-artemis-native
https://access.redhat.com/downloads/content/package-browser/ |
≥ 1:2.0.0-2.redhat_00005.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-aesh-extensions
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.8.0-2.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-aesh-readline
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.0-2.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-apache-commons-codec
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.16.1-2.redhat_00007.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-apache-commons-collections
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.2.2-28.redhat_2.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-apache-commons-io
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.15.1-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-apache-commons-lang
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.14.0-2.redhat_00006.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-apache-cxf
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.5-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-artemis-native
https://access.redhat.com/downloads/content/package-browser/ |
≥ 1:2.0.0-2.redhat_00005.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-artemis-wildfly-integration
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.1-1.redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-asyncutil
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:0.1.0-2.redhat_00010.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-aws-java-sdk
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.12.284-2.redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-cryptacular
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.2.5-2.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-eap-product-conf-parent
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:800.4.0-1.GA_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-fastinfoset
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.1.0-4.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-hibernate
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:6.2.31-1.Final_redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-hibernate-validator
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.1-3.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-hppc
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:0.8.1-2.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-insights-java-client
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.1.3-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-jakarta-servlet-jsp-jstl-api
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.0.1-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-jboss-cert-helper
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:1.1.3-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-jboss-logging
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.5.3-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-jctools
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:4.0.2-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-jgroups
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:5.3.10-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-log4j
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.22.1-1.redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-narayana
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:6.0.3-1.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-nimbus-jose-jwt
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:9.37.3-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-objectweb-asm
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:9.6.0-1.redhat_00002.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-pem-keystore
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.3.0-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-resteasy-extensions
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.1-3.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-resteasy-spring
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.0.1-2.Final_redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-saaj-impl
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.0.4-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-shibboleth-java-support
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.0-6.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-slf4j
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.0.16-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-snakeyaml
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:2.2.0-1.redhat_00001.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Red Hat eap8-wildfly
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:8.0.4-2.GA_redhat_00005.1.el9eap; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Single Sign-On 7 Red Hat keycloak-services
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat rh-sso7-keycloak
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:18.0.18-1.redhat_00001.1.el7sso; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat rh-sso7-keycloak
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:18.0.18-1.redhat_00001.1.el8sso; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Single Sign-On 7.6 for RHEL 9 Red Hat rh-sso7-keycloak
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:18.0.18-1.redhat_00001.1.el9sso; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| RHEL-8 based Middleware Containers Red Hat rh-sso-7/sso76-openshift-rhel8
https://catalog.redhat.com/software/containers/ |
≥ 7.6-54; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.1 medium |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2024:10385CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:10386CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6878CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6879CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6880CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6882CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6886CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6887CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6888CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6889CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:6890CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:8823CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:8824CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2024:8826CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-8883CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2312511CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.javaCNA: redhat
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.