Red Hat Security AdvisoryRHSA-2019:3050
Red Hat Single Sign-On 7.3.4 security update
Released 2019-10-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Single Sign-On 7.3.4 zip
Fixes 9 records
Priority MEDIUM 60
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08111 · Published 2019-07-29 · Partial fix · 2.9.9.2, 2.8.11.4 +1 CWE-1321
Priority MEDIUM 58
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.21949 · Published 2019-05-17 · Partial fix · 2.9.9, 2.8.11.4 +2 CWE-502
Priority MEDIUM 46
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01892 · Published 2019-10-02 · Partial fix · 2.0.20 CWE-532
Priority LOW 39
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10902 · Published 2019-06-19 · Partial fix · 2.9.9.1, 2.8.11.4 +2 CWE-502
Priority LOW 39
undertow before version 2.0.23.Final is vulnerable to an information leak issue.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03478 · Published 2019-07-25 · Partial fix · 2.0.23 CWE-862
Priority LOW 34
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.0054 · Published 2019-10-15 · Partial fix · 7.0.1 CWE-863
Priority LOW 34
A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01153 · Published 2020-05-08 · Partial fix · 8.0.0 CWE-267
Priority LOW 34
A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01283 · Published 2020-05-08 · Partial fix · 8.0.0 CWE-267
Priority LOW 21
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00717 · Published 2020-01-08 · Partial fix · 8.0.0 CWE-200
THREATIST.IORead the docs