A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR).
Client-provided parameters were found to be included in plain text in the
KC_RESTART cookie returned by the authorization server's HTTP response to a
`request_uri` authorization request, possibly leading to an information
disclosure vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4540
https://bugzilla.redhat.com/show_bug.cgi?id=2279303
https://www.cve.org/CVERecord?id=CVE-2024-4540
https://access.redhat.com/security/cve/CVE-2024-4540
https://access.redhat.com/errata/RHSA-2024:3566
https://access.redhat.com/errata/RHSA-2024:3567
https://access.redhat.com/errata/RHSA-2024:3568
https://access.redhat.com/errata/RHSA-2024:3570
https://access.redhat.com/errata/RHSA-2024:3572
https://access.redhat.com/errata/RHSA-2024:3573
https://access.redhat.com/errata/RHSA-2024:3574
https://access.redhat.com/errata/RHSA-2024:3575
https://access.redhat.com/errata/RHSA-2024:3576

Bug ID	1225899
Summary	VUL-0: CVE-2024-4540: python-python-keycloak: exposure of sensitive information in Pushed Authorization Requests (PAR) KC_RESTART cookie
Classification	openSUSE
Product	openSUSE Distribution
Version	Leap 15.6
Hardware	Other
URL	https://smash.suse.de/issue/408512/
OS	Other
Status	NEW
Severity	Major
Priority	P5 - None
Component	Security
Assignee	security-team@suse.de
Reporter	smash_bz@suse.de
QA Contact	security-team@suse.de
CC	abergmann@suse.com
Target Milestone	---
Found By	Security Response Team
Blocker	---