Red Hat Security Advisory

RHSA-2017:0872

Red Hat Single Sign-On 7.1 update on RHEL 6

Released 2017-04-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.1 for RHEL 6 Server rh-sso7-1-2.jbcs.el6, rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el6, rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el6 +13

Fixes 3 records

TI-2016-07810 CVE-2016-9589 · GHSA-p4xg-cpr9-vwvj

Uncontrolled resource consumption in Red Hat wildfly

LOW 38

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02965 Published 2018-03-12 Fixed in 11.0.0.Beta1 CWE-400

TI-2016-07091 CVE-2016-8629 · GHSA-778x-2mqv-w6xw

Improper access control in Red Hat Keycloak

LOW 33

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01901 Published 2018-03-12 Fixed in 2.4.0 CWE-284

TI-2017-01840 CVE-2017-2585 · GHSA-w6gv-3r3v-gwgj

Information disclosure in Red Hat keycloak

LOW 30

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01974 Published 2018-03-12 Partial fix · 2.5.1 CWE-200