CVE-2024-8698
Estado: AplazadaAlta (7.7)—💥 Exploit
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
- Puntuación base: 7.7
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.03%
- Percentil entre todas las CVEs puntuadas: 80
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Plantilla de Nuclei (detección automática y masiva) · Keycloak - SAML Core Package Signature Validation Flaw
- Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub
⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-347
Referencias
- https://access.redhat.com/errata/RHSA-2024:6878
- https://access.redhat.com/errata/RHSA-2024:6879
- https://access.redhat.com/errata/RHSA-2024:6880
- https://access.redhat.com/errata/RHSA-2024:6882
- https://access.redhat.com/errata/RHSA-2024:6886
- https://access.redhat.com/errata/RHSA-2024:6887
- https://access.redhat.com/errata/RHSA-2024:6888
- https://access.redhat.com/errata/RHSA-2024:6889
- https://access.redhat.com/errata/RHSA-2024:6890
- https://access.redhat.com/errata/RHSA-2024:8823
- https://access.redhat.com/errata/RHSA-2024:8824
- https://access.redhat.com/errata/RHSA-2024:8826
- https://access.redhat.com/security/cve/CVE-2024-8698
- https://bugzilla.redhat.com/show_bug.cgi?id=2311641
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-8698",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-8698",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-09-19T17:28:59.153864Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 7.7,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.3,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "25.0.5",
"versionType": "semver"
}
],
"packageName": "keycloak",
"collectionURL": "https://github.com/keycloak/keycloak",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:22"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:24"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"packageName": "keycloak-saml-core",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:22::el9"
],
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 22",
"versions": [
{
"status": "unaffected",
"version": "22.0.13-1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhbk/keycloak-operator-bundle",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:22::el9"
],
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 22",
"versions": [
{
"status": "unaffected",
"version": "22-18",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhbk/keycloak-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:22::el9"
],
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 22",
"versions": [
{
"status": "unaffected",
"version": "22-21",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhbk/keycloak-rhel9-operator",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:24::el9"
],
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 24",
"versions": [
{
"status": "unaffected",
"version": "24.0.8-1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhbk/keycloak-operator-bundle",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:24::el9"
],
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 24",
"versions": [
{
"status": "unaffected",
"version": "24-17",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhbk/keycloak-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:24::el9"
],
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 24",
"versions": [
{
"status": "unaffected",
"version": "24-17",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhbk/keycloak-rhel9-operator",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"packageName": "keycloak-saml-core-public",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"packageName": "org.keycloak-keycloak-parent",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.33.0-1.redhat_00015.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-activemq-artemis",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "1:2.0.0-2.redhat_00005.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-activemq-artemis-native",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.8.0-2.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-aesh-extensions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.0-2.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-aesh-readline",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.16.1-2.redhat_00007.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-codec",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.2.2-28.redhat_2.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-collections",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.15.1-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-io",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.14.0-2.redhat_00006.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-lang",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.5-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-cxf",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "1:2.0.0-2.redhat_00005.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-artemis-native",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.0.1-1.redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-artemis-wildfly-integration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:0.1.0-2.redhat_00010.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-asyncutil",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.12.284-2.redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-aws-java-sdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.2.5-2.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-cryptacular",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:800.4.0-1.GA_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-eap-product-conf-parent",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.1.0-4.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-fastinfoset",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:6.2.31-1.Final_redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-hibernate",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:8.0.1-3.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-hibernate-validator",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:0.8.1-2.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-hppc",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.3-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-insights-java-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.1-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jakarta-servlet-jsp-jstl-api",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.3-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jboss-cert-helper",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.5.3-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jboss-logging",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.2-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jctools",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:5.3.10-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jgroups",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.22.1-1.redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-log4j",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:6.0.3-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-narayana",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:9.37.3-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-nimbus-jose-jwt",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:9.6.0-1.redhat_00002.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-objectweb-asm",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.3.0-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-pem-keystore",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.0.1-3.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-resteasy-extensions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.1-2.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-resteasy-spring",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.4-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-saaj-impl",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:8.0.0-6.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-shibboleth-java-support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.0.16-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-slf4j",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.0-1.redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-snakeyaml",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:8.0.4-2.GA_redhat_00005.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.33.0-1.redhat_00015.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-activemq-artemis",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "1:2.0.0-2.redhat_00005.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-activemq-artemis-native",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.8.0-2.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-aesh-extensions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.0-2.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-aesh-readline",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.16.1-2.redhat_00007.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-codec",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.2.2-28.redhat_2.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-collections",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.15.1-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-io",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.14.0-2.redhat_00006.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-commons-lang",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.5-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-apache-cxf",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "1:2.0.0-2.redhat_00005.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-artemis-native",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.0.1-1.redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-artemis-wildfly-integration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:0.1.0-2.redhat_00010.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-asyncutil",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.12.284-2.redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-aws-java-sdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.2.5-2.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-cryptacular",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:800.4.0-1.GA_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-eap-product-conf-parent",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.1.0-4.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-fastinfoset",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:6.2.31-1.Final_redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-hibernate",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:8.0.1-3.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-hibernate-validator",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:0.8.1-2.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-hppc",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.3-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-insights-java-client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.1-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jakarta-servlet-jsp-jstl-api",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.1.3-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jboss-cert-helper",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.5.3-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jboss-logging",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.0.2-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jctools",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:5.3.10-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-jgroups",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.22.1-1.redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-log4j",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:6.0.3-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-narayana",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:9.37.3-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-nimbus-jose-jwt",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:9.6.0-1.redhat_00002.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-objectweb-asm",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.3.0-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-pem-keystore",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.0.1-3.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-resteasy-extensions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.1-2.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-resteasy-spring",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:3.0.4-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-saaj-impl",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:8.0.0-6.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-shibboleth-java-support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.0.16-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-slf4j",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.0-1.redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-snakeyaml",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:8.0.4-2.GA_redhat_00005.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap8-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6"
],
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"packageName": "keycloak-saml-core",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
],
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:18.0.18-1.redhat_00001.1.el7sso",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rh-sso7-keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
],
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:18.0.18-1.redhat_00001.1.el8sso",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rh-sso7-keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:18.0.18-1.redhat_00001.1.el9sso",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rh-sso7-keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"versions": [
{
"status": "unaffected",
"version": "7.6-54",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rh-sso-7/sso76-openshift-rhel8",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"packageName": "keycloak-saml-core-public",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"packageName": "keycloak-saml-core-public",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
]
}
],
"published": "2024-09-19T16:15:06.177",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2024:6878",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6879",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6880",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6882",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6886",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6887",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6888",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6889",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:6890",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:8823",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:8824",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:8826",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-8698",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311641",
"source": "secalert@redhat.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks."
},
{
"lang": "es",
"value": "Existe una falla en el método de validación de firma SAML dentro de la clase XMLSignatureUtil de Keycloak. El método determina incorrectamente si una firma SAML es para el documento completo o solo para afirmaciones específicas según la posición de la firma en el documento XML, en lugar del elemento Reference utilizado para especificar el elemento firmado. Esta falla permite a los atacantes crear respuestas manipuladas que pueden eludir la validación, lo que puede provocar ataques de suplantación o escalada de privilegios."
}
],
"lastModified": "2026-08-04T09:16:34.540",
"sourceIdentifier": "secalert@redhat.com"
}