Chess Hazlett

Foi identificada uma vulnerabilidade de injeção de script no conector de banco de dados Debezium, devido à sanitização inadequada de alguns parâmetros. Essa falha permite que um invasor envie uma solicitação maliciosa para injetar um parâmetro que pode possibilitar a visualização de dados não autorizados.

Foi identificada uma falha no Keycloak devido à aplicação incorreta dos tipos de token durante a validação de assinaturas localmente. Isso poderia permitir que um invasor autenticado trocasse um token de logout por um token de acesso e, possivelmente, obtivesse acesso a dados fora das permissões definidas.

Foi encontrada uma falha no mecanismo de autenticação step-up do cliente, onde a autenticação não é validada corretamente. Isso permite que um usuário remoto autenticado com uma senha registre um segundo fator de autenticação falso junto com um já existente, contornando a autenticação. O problema está relacionado ao módulo `org.keycloak.authentication`.

Foi identificada uma falha no pacote Undertow que permite que um usuário mal-intencionado provoque uma negação de serviço (DoS) ao enviar solicitações manipuladas, levando o servidor a um erro de falta de memória e esgotando a memória do servidor. A vulnerabilidade existe devido à validação insuficiente de entradas. A exploração da vulnerabilidade pode permitir que um invasor remoto cause uma negação de serviço.

A flaw was found in the software, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. The flaw is the result of an incomplete fix for a previous issue.

An improper initialization issue was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This could allow an attacker to access remote HTTP services available from the server.

The issue is related to the incorrect implementation of the sequence of actions in the Quarkus Java framework's WebSocket technology, resulting from insufficient access restriction when processing GraphQL requests. This can allow a remote attacker to gain unauthorized access to protected information and elevate their privileges. The problem occurs when a request is received over WebSocket with no role-based permission specified on the GraphQL operation, and Quarkus processes the request without authentication despite the endpoint being secured.

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application. The vulnerability is related to the disclosure of information through environment variables.

A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR. However, these passwords are shown in plaintext in the StatefulSet details yaml of AMQ Broker.

A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.

A flaw in the Skupper operator may allow an authenticated attacker in an adjacent cluster to view deployments in all namespaces, permitting unauthorized access to information outside of the user's purview. The issue is related to inadequate access control, which can be exploited to gain unauthorized access to protected information.

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

The issue is related to the improper implementation of security checks for standard elements in Keycloak, a software tool for identity and access management. This can allow a remote attacker to gain unauthorized access to protected information. Specifically, Keycloak's device authorization grant does not correctly validate the `device code` and `client ID`. An attacker client could abuse this missing validation to spoof a client consent request, potentially tricking an authorization admin into granting consent to a malicious OAuth client or allowing unauthorized access to an existing OAuth client. Under certain conditions, the vulnerability enables an attacker to spoof parts of the device flow and use a `device code` to retrieve an access token for other OAuth clients.

A flaw was found in Keycloak where a server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. This allows a client with a proper certificate to authorize itself as any other client, accessing data belonging to other clients. The issue is related to errors in the certificate verification procedure, which can be exploited by a remote attacker to impact the confidentiality and integrity of protected information.

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service. The vulnerability is related to the deserialization of untrusted data, which can be exploited by a remote attacker to cause a denial of service by sending specially crafted requests.

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration. The issue is related to the default access control settings of the Keycloak identity and access management tool, which can be exploited by a remote attacker to execute arbitrary code.

Foi identificada uma falha no núcleo do Drools, na qual algumas classes utilitárias não utilizavam proteções adequadas ao deserializar dados. Isso permite que um invasor autenticado crie objetos serializados maliciosos, geralmente chamados de “gadgets”, e consiga executar código no servidor. A vulnerabilidade está relacionada à restauração de dados não confiáveis na memória, o que pode ser explorado por um invasor remoto para executar código arbitrário.

O problema decorre da sanitização inadequada das entradas do usuário em vários campos, permitindo que um usuário autenticado injete scripts. Isso poderia levar ao acesso a informações confidenciais ou a novos ataques.

O componente de interface do usuário (UI) de métricas de integridade do smallrye não sanitizava adequadamente algumas entradas do usuário, permitindo que um invasor realizasse ataques de script entre sites (XSS).