Read the docs
Red Hat Security Advisory

RHSA-2019:3046

Red Hat Single Sign-On 7.3.4 security update on RHEL 8

Released 2019-10-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2019-10718 CVE-2019-14379 · GHSA-6fpp-rgj9-8rwc

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default…

Priority MEDIUM 60

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08111 Published 2019-07-29 Partial fix · 2.9.9.2, 2.8.11.4 +1 CWE-1321
TI-2019-07505 CVE-2019-10184 · GHSA-w69w-jvc7-wjgv

Missing authorization in undertow-io undertow

Priority LOW 39

undertow before version 2.0.23.Final is vulnerable to an information leak issue.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03478 Published 2019-07-25 Partial fix · 2.0.23 CWE-862
TI-2019-11037 CVE-2019-14832 · GHSA-8prc-58j4-m55q

Incorrect authorization in keycloak REST API

Priority LOW 34

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0054 Published 2019-10-15 Partial fix · 7.0.1 CWE-863
TI-2019-11025 CVE-2019-14820 · GHSA-xfqh-7356-vqjj

Information disclosure in keycloak

Priority LOW 21

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00717 Published 2020-01-08 Partial fix · 8.0.0 CWE-200