Red Hat Security Advisory

RHSA-2018:2428

Red Hat Single Sign-On 7.2.4 security update

Released 2018-08-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.2.4 zip

Fixes 6 records

TI-2018-05816 CVE-2018-8039 · GHSA-jc7r-v6fg-2gpf

Improper handling of exceptional conditions in Apache CXF

MEDIUM 46

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.08507 Published 2018-07-02 Partial fix · 3.1.16, 3.2.5 CWE-755

TI-2018-15829 CVE-2018-1000180 · GHSA-xqj7-j8j5-f2xr

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the…

LOW 39

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have l…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0342 Published 2018-06-05 Partial fix · 1.60 CWE-327

TI-2018-07261 CVE-2018-10237 · GHSA-mvr2-9pj6-7w5j

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote…

LOW 38

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data,…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.08449 Published 2018-04-26 Partial fix · 24.1.1-android CWE-770

TI-2017-09349 CVE-2017-12624 · GHSA-7vgj-8mw4-hg8r

Improper input validation in Apache CXF

LOW 31

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications.

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.03697 Published 2017-11-14 Partial fix · 3.1.14, 3.2.1 +1 CWE-20

TI-2018-07676 CVE-2018-10862 · GHSA-w8r2-5j8x-x8j6

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war…

LOW 27

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.01262 Published 2018-07-27 Partial fix · 6.0.0.Alpha3 CWE-22

TI-2018-07724 CVE-2018-10912 · GHSA-h7j7-pw3v-3v3x

Infinite loop in [UNKNOWN] keycloak

LOW 25

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0131 Published 2018-07-23 Partial fix · 4.0.0 CWE-835