Red Hat Security Advisory

RHSA-2018:3593

Red Hat Single Sign-On 7.2.5 on RHEL 7 security and bug fix update

Released 2018-11-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.2 for RHEL 7 Server rh-sso7-keycloak-3.4.14-1.Final_redhat_00001.1.jbcs.el7, rh-sso7-keycloak-server-3.4.14-1.Final_redhat_00001.1.jbcs.el7

TI-2018-10520 CVE-2018-14657 · GHSA-85v8-vx4w-q684

LOW 38

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01159 Published 2018-11-13 Partial fix · 4.6.0.Final CWE-307

TI-2018-10502 CVE-2018-14637 · GHSA-gf2j-7qwg-4f5x

LOW 37

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00814 Published 2018-11-30 Partial fix · 4.6.0 CWE-285

TI-2018-10521 CVE-2018-14658 · GHSA-3qh2-mccc-q5m6

LOW 29

A flaw was found in JBOSS Keycloak 3.2.1.Final.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01097 Published 2018-11-13 Partial fix CWE-601

TI-2018-10518 CVE-2018-14655 · GHSA-458h-wv48-fq75

LOW 27

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01194 Published 2018-11-13 Partial fix CWE-79

TI-2018-07707 CVE-2018-10894 · GHSA-xvv8-8wh9-9fh2

LOW 24

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates.

CVSS 3.0MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00352 Published 2018-08-01 Partial fix · 4.4.0.Final CWE-345