SB2025032152 - Dell Data Protection Central update for third-party component
Published: March 21, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2024-37370)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
2) Uncaught Exception (CVE-ID: CVE-2023-32695)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper error handling. A remote attacker can send a specially crafted Socket.IO packet to the application and perform a denial of service (DoS) attack.
3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-42461)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error when handling BER-encoded ECDSA signatures. A remote attacker can bypass signature-based security checks.
4) Reliance on Reverse DNS Resolution for a Security-Critical Action (CVE-ID: CVE-2023-31442)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to async-dns resolver (used by Discovery in DNS mode and transitively by Cluster Bootstrap) uses predictable DNS transaction IDs when resolving DNS records. A remote attacker can exploit the vulnerability to perform a denial of service attack.
5) Use-after-free (CVE-ID: CVE-2024-25062)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in xmlValidatePopElement when using the XML Reader interface with DTD validation and XInclude expansion enabled. A remote attacker can pass a specially crafted XML document to the application, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
6) Resource exhaustion (CVE-ID: CVE-2023-52428)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of user requests by the PasswordBasedDecrypter (PBKDF2) component. A remote attacker can send a specially crafted request using a large JWE p2c header, trigger resource exhaustion and perform a denial of service (DoS) attack.
7) Improper input validation (CVE-ID: CVE-2024-21147)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
8) Open redirect (CVE-ID: CVE-2024-8883)
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to a misconfiguration when handling redirects. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-3656)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to improperly imposed security restrictions on the administrative features. A remote low privileged user can utilize administrative functionalities within Keycloak admin interface and escalate privileges within the application.
10) Session Fixation (CVE-ID: CVE-2024-7341)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the session fixation issue in the SAML adapters. A remote user who hijacks the current session before authentication can trigger session fixation.
11) Resource exhaustion (CVE-ID: CVE-2024-47554)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when handling untrusted input passed to the org.apache.commons.io.input.XmlStreamReader class. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
12) Improper verification of cryptographic signature (CVE-ID: CVE-2024-8698)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to improper validation of SAML signature within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. A remote user can create crafted responses that bypass the validation, potentially leading to privilege escalation or impersonation attacks.
13) Cleartext storage of sensitive information (CVE-ID: CVE-2024-2700)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to cleartext storage of sensitive information in an environment variable. A local user can exploit this vulnerability to obtain local configuration properties information, and use this information to launch further attacks against the affected system.
14) Path traversal (CVE-ID: CVE-2024-2419)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to an error in the redirect_uri validation logic within org.keycloak.protocol.oidc.utils. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.
15) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-1249)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to "checkLoginIframe" allows unvalidated cross-origin messages. A remote attacker can send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.
16) Information disclosure (CVE-ID: CVE-2024-4540)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to an error in the OAuth 2.0 Pushed Authorization Requests (PAR) implementation. Client provided parameters are included in plain text in to
the KC_RESTART cookie returned by the authorization server's HTTP
response to a request_uri authorization request. A local user with access to the system can use the cookie to gain access to sensitive information.
17) Path traversal (CVE-ID: CVE-2024-1132)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to improper validation of URLs included in a redirect in org.keycloak.protocol.oidc. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Note, the vulnerability affects any client that utilizes a wildcard in the Valid Redirect URIs field.
Remediation
Install update from vendor's website.