Red Hat Security AdvisoryRHSA-2019:3049
RH-SSO 7.3.4 adapters for Enterprise Application Platform 7.2 security update
Released 2019-10-14 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap, eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap, eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap, eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap
Fixes 1 record
Priority LOW 21
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00717 · Published 2020-01-08 · Partial fix · 8.0.0 CWE-200
