Red Hat Security Advisory

RHSA-2018:3595

Red Hat Single Sign-On 7.2.5 security and bug fix update

Released 2018-11-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2018-10520 CVE-2018-14657 · GHSA-85v8-vx4w-q684

LOW 38

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01159 Published 2018-11-13 Partial fix · 4.6.0.Final CWE-307

TI-2018-10502 CVE-2018-14637 · GHSA-gf2j-7qwg-4f5x

LOW 37

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00814 Published 2018-11-30 Partial fix · 4.6.0 CWE-285

TI-2018-10521 CVE-2018-14658 · GHSA-3qh2-mccc-q5m6

LOW 29

A flaw was found in JBOSS Keycloak 3.2.1.Final.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01097 Published 2018-11-13 Partial fix CWE-601

TI-2018-10492 CVE-2018-14627 · GHSA-x5xm-f46c-5cpq

LOW 29

The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01112 Published 2018-09-04 Partial fix CWE-319

TI-2018-10518 CVE-2018-14655 · GHSA-458h-wv48-fq75

LOW 27

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01194 Published 2018-11-13 Partial fix CWE-79

TI-2018-07707 CVE-2018-10894 · GHSA-xvv8-8wh9-9fh2

LOW 24

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates.

CVSS 3.0MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00352 Published 2018-08-01 Partial fix · 4.4.0.Final CWE-345