Red Hat RHEL-8 based Middleware Containers
35 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-7507 | | Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover | HIGH 7.5 | 0.8 % | ||
| CVE-2026-7307 | | Keycloak: keycloak: denial of service via specially crafted saml input | HIGH 7.5 | 0.9 % | ||
| CVE-2026-4634 | | Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters | HIGH 7.5 | 0.6 % | ||
| CVE-2026-5121 | | Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing | CRITICAL 9.8 | 1.1 % | ||
| CVE-2026-4424 | | Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing | HIGH 7.5 | 1.3 % | ||
| CVE-2026-2575 | | Keycloak: keycloak: denial of service due to excessive samlrequest decompression | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-2092 | | Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions | HIGH 7.7 | 0.4 % | ||
| CVE-2025-14831 | | Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification | MEDIUM 5.3 | 0.7 % | ||
| CVE-2025-9820 | | Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function | MEDIUM 4.0 | 0.2 % | ||
| CVE-2026-0603 | | Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection | HIGH 8.3 | 1.0 % | ||
| CVE-2025-6020 | | Linux-pam: linux-pam directory traversal | HIGH 7.8 | 0.5 % | ||
| CVE-2025-4057 | corrigé en 7.12.5-2 | Activemq-artemis-operator: amq broker operator starting credentials reuse | MEDIUM 5.5 | 0.2 % | ||
| CVE-2024-7341 | | Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters | HIGH 7.1 | 0.8 % | ||
| CVE-2024-4629 | | Keycloak: potential bypass of brute force protection | MEDIUM 6.5 | 0.8 % | ||
| CVE-2024-5967 | | Keycloak: leak of configured ldap bind credentials through the keycloak admin console | LOW 2.7 | 0.6 % | ||
| CVE-2024-4540 | | Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie | HIGH 7.5 | 0.6 % | ||
| CVE-2023-6544 | | Keycloak: authorization bypass | MEDIUM 5.4 | 1.1 % | ||
| CVE-2023-6484 | | Keycloak: log injection during webauthn authentication or registration | MEDIUM 5.3 | 1.0 % | ||
| CVE-2024-1249 | | Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos | HIGH 7.4 | 0.4 % | ||
| CVE-2024-1132 | | Keycloak: path transversal in redirection validation | HIGH 8.1 | 1.6 % | ||
| CVE-2024-1635 | | Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol | HIGH 7.5 | 4.6 % | ||
| CVE-2023-6291 | | Keycloak: redirect_uri validation bypass | HIGH 7.1 | 0.9 % | ||
| CVE-2023-2585 | corrigé en 7.6-24 | Keycloak: client access via device auth request spoof | HIGH 8.1 | 0.7 % | ||
| CVE-2023-6927 | | Keycloak: open redirect via "form_post.jwt" jarm response mode | MEDIUM 6.1 | 1.1 % | ||
| CVE-2023-6134 | | Keycloak: reflected xss via wildcard in oidc redirect_uri | MEDIUM 5.4 | 1.3 % | ||
| CVE-2023-6563 | corrigé en 7.6-38 | Keycloak: offline session token dos | HIGH 7.7 | 1.2 % | ||
| CVE-2023-2422 | corrigé en 7.6-24 | Keycloak: oauth client impersonation | HIGH 7.1 | 0.5 % | ||
| CVE-2023-4066 | corrigé en 7.11.1-9 | Operator: passwords defined in secrets shown in statefulset yaml | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-3223 | | Undertow: outofmemoryerror due to @multipartconfig handling | HIGH 7.5 | 2.7 % | ||
| CVE-2023-4065 | corrigé en 7.11.1-9 | Operator: plaintext password in operator log | MEDIUM 5.5 | 0.2 % | ||
| CVE-2022-4039 | corrigé en 7.6-20 | Rhsso-container-image: unsecured management interface exposed to adjecent network | CRITICAL 9.8 | 0.8 % | ||
| CVE-2022-3916 | | Keycloak: session takeover with oidc offline refreshtokens | MEDIUM 6.8 | 1.0 % | ||
| CVE-2022-1438 | corrigé en 7.6-20 | Keycloak: xss on impersonation under specific circumstances | MEDIUM 6.4 | 0.7 % | ||
| CVE-2023-4853 | | Quarkus: http security policy bypass | HIGH 8.1 | 1.4 % | ||
| CVE-2023-1108 | | Undertow: infinite loop in sslconduit during close | HIGH 7.5 | 1.8 % |