SB2024092059 - Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
Published: September 20, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2024-4629)
The vulnerability allows a remote attacker to perform a brute-force attack.
The vulnerability exists due to an error when handling unsuccessful login attempts. A remote attacker can initiate multiple login requests simultaneously and bypass the configured limits for failed attempts before the system locks them out.
2) Session Fixation (CVE-ID: CVE-2024-7341)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the session fixation issue in the SAML adapters. A remote user who hijacks the current session before authentication can trigger session fixation.
3) Information disclosure (CVE-ID: CVE-2024-5967)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to the LDAP testing endpoint allows to change the Connection URL independently
of and without having to re-enter the currently configured LDAP bind
credentials. A remote privileged user can modify the LDAP host URL ("Connection URL") to the attacker-controlled system and force the application to send credentials to a malicious server.
Remediation
Install update from vendor's website.