A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2022:8961 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2022:8962 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2022:8963 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2022:8964 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2022:8965 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:1043 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:1044 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:1045 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:1047 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2023:1049 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2022-3916 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2141404 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
No history.
Information
Published : 2023-09-20 15:15
Updated : 2023-11-07 03:51
NVD link : CVE-2022-3916
Mitre link : CVE-2022-3916
CVE.ORG link : CVE-2022-3916
JSON object : View
Products Affected
redhat
- openshift_container_platform_ibm_z_systems
- single_sign-on
- openshift_container_platform_for_linuxone
- enterprise_linux
- openshift_container_platform
- openshift_container_platform_for_power
- keycloak