Read the docs
Red Hat Security Advisory

RHSA-2018:0501

Red Hat Single Sign-On 7.2.1 security update

Released 2018-03-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 3 records

TI-2017-11063 CVE-2017-15089 · GHSA-46r5-59fg-2fjc

Deserialization of untrusted data in infinispan

Priority MEDIUM 43

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02827 Published 2018-02-15 Partial fix · 9.2.0.CR1 CWE-502
TI-2016-00670 CVE-2016-0750 · GHSA-4hhg-8ghq-vwq6

Deserialization of untrusted data in Red Hat Infinispan

Priority MEDIUM 43

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02419 Published 2018-09-11 Partial fix · 9.1.0.Final CWE-138
TI-2017-01916 CVE-2017-2670 · GHSA-3x7h-5hfr-hvjm

Infinite loop in [UNKNOWN] undertow

Priority LOW 39

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03616 Published 2018-07-27 Partial fix · 1.3.28 CWE-835