Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
98
security advisoryred hatimportantRed Hat: RHSA-2022:8961-01 Important: Keycloak Session Takeover
New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.6.1 security update on RHEL 7 Advisory ID: RHSA-2022:8961-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:8961 Issue date: 2022-12-13 CVE Names: CVE-2022-3782 CVE-2022-3916 ==================================================================== 1. Summary: New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.6 for RHEL 7 Server - noarch 3. Description: Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.1 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes the security fixes listed below. Security Fix(es): * keycloak: path traversal via double URL encoding (CVE-2022-3782) * keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includesthe changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2138971 - CVE-2022-3782 keycloak: path traversal via double URL encoding 2141404 - CVE-2022-3916 keycloak: Session takeover with OIDC offline refreshtokens 6. JIRA issues fixed (https://issues.redhat.com/): CIAM-4414 - Build RPMs for this patch 7. Package List: Red Hat Single Sign-On 7.6 for RHEL 7 Server: Source: rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el7sso.src.rpm noarch: rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el7sso.noarch.rpm rh-sso7-keycloak-server-18.0.3-1.redhat_00002.1.el7sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2022-3782 https://access.redhat.com/security/cve/CVE-2022-3916 https://access.redhat.com/security/updates/classification/#important 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY5ipotzjgjWX9erEAQjCBA//UBYUDvesP1x2wXWYvnR28asrOWhGk7tA n2G9Rf8/9jkZS2QetFy9xLsSBVGEOz+4ZhnyMST5XgjRkdpC+TcpcjgkgZ+w3V6X fSfbeyC3SvxK9S8+s59yrRHmBbkXBhlJf37BEXhWaJXJ0FTO72NvPM1vUWRKWW1w vK5/CW27UBTqxNgpXSiBeO/rIVRbknVCxD+YXQlwaGW8+jvxWzo/8JJ/nshJ1bDg 5Q3mC6kuv5SFpF4UhjGBQAuw+COoMZ+4FNRSUNWuErpvPd1YpEDyEEfxT1tArZDM IKWxpaVSNnFvKrkAqFUs6uuNiW/vzc+Sm7u79Ax0o6WUpD3J3t7oAstS8FWHM6qL WFuEUv0sKROLtR1o1IxROwjlMRyJXhTKwNZI3A8xG762/tFX9N0y1tJFO5rm/Wqf cXsi9fily473Y+JCnTNQS0rrwhy3ZV2w3SFM1lcrgMA5Y3BuRYqz63yLq8EsYMwX hW/1TgBj0QBP5QLlncs9eFF+vfvSFMq5780JJhniTkmdfLtuIPlWhFPjpwcA0XKY K+pVXDSfZ76V4mZaNKN8JQnps/xvbc7rUHjWZ8MCi2PDnZwpzj2KT+WjI31YsQbe 5CHaMYS5ikZ3P2xHQIqaacAmEUqrYHo1dI75KZ9azjXcubgMk5/KNXD+gmo0bmnX uI04HxR4UHc=9d1O -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 13, 2022
•Important
Red Hat
98
security advisoryimportantpath traversalRed Hat Single Sign-On 7.6.1 Advisory RHSA-2022:8963-01 Important Severity
New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.6.1 security update on RHEL 9 Advisory ID: RHSA-2022:8963-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:8963 Issue date: 2022-12-13 CVE Names: CVE-2022-3782 CVE-2022-3916 ==================================================================== 1. Summary: New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.6 for RHEL 9 - noarch 3. Description: Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.1 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes the security fixes listed below. Security Fix(es): * keycloak: path traversal via double URL encoding (CVE-2022-3782) * keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2138971 - CVE-2022-3782 keycloak: path traversal via double URL encoding 2141404 - CVE-2022-3916 keycloak: Session takeover with OIDC offline refreshtokens 6. JIRA issues fixed (https://issues.redhat.com/): CIAM-4414 - Build RPMs for this patch 7. Package List: Red Hat Single Sign-On 7.6 for RHEL 9: Source: rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el9sso.src.rpm noarch: rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el9sso.noarch.rpm rh-sso7-keycloak-server-18.0.3-1.redhat_00002.1.el9sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2022-3782 https://access.redhat.com/security/cve/CVE-2022-3916 https://access.redhat.com/security/updates/classification/#important 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY5ipndzjgjWX9erEAQhVcxAAnTGHyVcLWPvYT8iwc9H8oDFxvLGgHmzc dWM5kJDBs6in9LmpRfuK+e2+ImTB51tJevuhhlWK352/sNaNLUqRDVwh3lC+5j/I Wg9OVsLlSDrlaB8XPUP2W7yDa8ZHc4SMb6t4h/h7xKc4ylLAJNM2K/d/wiisAK3n 154VOxiaQJjfSOk1EPJipg6oe8iT0ytStcWqxstpvVQj8oWEvyghzeZyQbcy/+Ar 9L7lc43jCkZWq8LVRznX4SwooqJvsARuvw9M54dvaWAkdr4lme07BIAY2AEIk1k3 fB3to4RtSb2I6H/PsJn2uZ4r0aeigWMTEG4M+8RluAjjglVtBISjwzQ4WAahwL7o 2Gjoxpoe81WFSLAqwvmNdqQplJSMVajymKweFVQBZih0VGYTCGR/LRCg57Fjh3UZ o96jAUIjR7DtXrU0PtuXvDyi4L8dNFRHh4oXzFVGH+0VyT/QSOonEJM2qcDcXFjv OD19J3457M+qTrJkqeeuFY5UhyfxzCD5fcDzOlt4YK95ptx+0dV4dlbDq3ECGbw9 jWX1QGKnXFjsljZLCacT1RoS6wwWnDg8ZTIDZdm1FKyEA9wlqhuJMPgKFpTri7y0 YYO14rCXVuKkoHBVB+sgpup4w2B47v897DtGw+J51hWBdmYg/miYiEUbod+Z3V8t 7C6RUvKvSmo=XpnE -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 13, 2022
•Important
Red Hat
98
security advisoryRed HatauthenticationRed Hat: RHSA-2022:8962-01 Important: Single Sign-On 7.6.1 Security Issues
New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.6.1 security update on RHEL 8 Advisory ID: RHSA-2022:8962-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:8962 Issue date: 2022-12-13 CVE Names: CVE-2022-3782 CVE-2022-3916 ==================================================================== 1. Summary: New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.6 for RHEL 8 - noarch 3. Description: Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.1 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes the security fixes listed below. Security Fix(es): * keycloak: path traversal via double URL encoding (CVE-2022-3782) * keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2138971 - CVE-2022-3782 keycloak: path traversal via double URL encoding 2141404 - CVE-2022-3916 keycloak: Session takeover with OIDC offline refreshtokens 6. JIRA issues fixed (https://issues.redhat.com/): CIAM-4414 - Build RPMs for this patch 7. Package List: Red Hat Single Sign-On 7.6 for RHEL 8: Source: rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el8sso.src.rpm noarch: rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el8sso.noarch.rpm rh-sso7-keycloak-server-18.0.3-1.redhat_00002.1.el8sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2022-3782 https://access.redhat.com/security/cve/CVE-2022-3916 https://access.redhat.com/security/updates/classification/#important 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY5ipldzjgjWX9erEAQiTxQ//X1uZTMfjqFKgWwdGQx+411ANW503To42 itxaBWhSxJmbzOhJB0QKoABPCapl3mwrPC+XfdGL2sorqFFjbXNa6TkaQecfVqt2 qwTqtEix3WQVmK2PY9e//9sea/vwfwBOfhqxgiML3ZMzrfXHzIgnWNSPE5eYT+n9 riKkquCR7kInls3lkxgpKEQjsJXyR1FhIGzS4J8tmgHsG46zOF4fYsPI2BVj6VJg Y55XjFXoPjZdKWzdHNVBzuRIuoCBEToZHPNzA4D387FsAPSqVwrEQ5S0VUL7bJ/t WY03oVmytyvgwUnwzUSy1qgFDpzY68YAtCLdO2sNPqybiFUKAWevhCNK8Dksf7VM zUpmIZF5EtKAQZIF1LH+DTtwWJr+Uvy/vnbA+CqwwUcQv6/mKQIBLsIHMaLyB3Bu 3KSksEllW6XQ+c1JFQ1BmDdkyHhmRYXxxkGqxmtW7cFj4K+rnWqu+o7IRJvbXUJM F3ryJcFk/0tYmzHUqCgQZQvJQwF5QCVZdIMZrAAI6ugGE5m2VeSJBgb+aHNIwn9/ Ji9OdKRuzPJFjmuZy67RaFbF37ILTeQB6uVPz0PLjcjJZAP/NN5CjWbTS/D7Q0J/ RgIZe5uv4sYOkH0+jd6CYQp7GVXlPvT/uVE3eONol+FgT5lyf6fWZE2vjQQsO/26 ZyVkdE4wcmo=CFoY -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 13, 2022
•Important
Red Hat
198
security advisoryremote accesslow severityArch Linux: ASA-202106-19 Low Severity: Keycloak Session Takeover Risk
The package keycloak before version 13.0.1-1 is vulnerable to incorrect calculation. . Arch Linux Security Advisory ASA-202106-19 ========================================= Severity: Low Date : 2021-06-01 CVE-ID : CVE-2021-3461 Package : keycloak Type : incorrect calculation Remote : Yes Link : https://security.archlinux.org/AVG-1994 Summary ====== The package keycloak before version 13.0.1-1 is vulnerable to incorrect calculation. Resolution ========= Upgrade to 13.0.1-1. # pacman -Syu "keycloak> =13.0.1-1" The problem has been fixed upstream in version 13.0.1. Workaround ========= None. Description ========== Keycloak may fail to logout a user session if the logout request comes from an external SAML identity provider that is set up to identify the principal via attributes rather than by Subject Name ID. Impact ===== A remote attacker could take over a logged out user session if they manage to obtain the old session token. References ========= https://bugzilla.redhat.com/show_bug.cgi?id=1941565 https://github.com/keycloak/keycloak/commit/f014299e7c781dff2b492b81bc81adcf717bd530 https://security.archlinux.org/CVE-2021-3461 . The recent Debian Security Advisory DSA-2023-45 addresses a medium severity issue found in OpenLDAP that enables possible information disclosure risks.. Arch Linux, Keycloak, Remote Access, Security Advisory, Calculation Issue. . Severity: Low. LinuxSecurity.com Team
Jun 03, 2021
•Low
ArchLinux
87
security advisorydenial of servicedebianDebian: DSA-2332-1 Moderate: Python-Django Session Takeover
Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework: CVE-2011-4136 . - ------------------------------------------------------------------------- Debian Security Advisory DSA-2332-1
Oct 29, 2011
Debian
87
security advisoryDebianlocal exploitDebian DSA 660-1 Critical: KDE Screensaver Local Session Takeover
Raphaël Enrici discovered that the KDE screensaver can crash under certain local circumstances. This can be exploited by an attacker with physical access to the workstation to take over the desktop session.. - --------------------------------------------------------------------------Debian Security Advisory DSA 660-1
Jan 26, 2005
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!