Read the docs
Red Hat Security Advisory

RHSA-2020:0445

Red Hat Single Sign-On 7.3.6 security update

Released 2020-02-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 13 records

TI-2019-07494 CVE-2019-10173 · GHSA-hf23-9pf7-388p

Code injection in xstream

Priority CRITICAL 86

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.95036 Published 2019-07-23 Fixed in 1.4.11 CWE-94
TI-2019-11096 CVE-2019-14892 · GHSA-cf6r-3wgc-h863

Information disclosure in Red Hat jackson-databind

Priority MEDIUM 57

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05576 Published 2020-03-02 Partial fix · 2.9.10, 2.8.11.5 +1 CWE-200
TI-2019-11097 CVE-2019-14893 · GHSA-qmqc-x3r4-6v39

Information disclosure in Red Hat jackson-databind

Priority MEDIUM 56

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction wi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04091 Published 2020-03-02 Partial fix · 2.9.10 CWE-200
TI-2019-11092 CVE-2019-14888 · GHSA-vjxc-frw4-jmh5

Uncontrolled resource consumption in Red Hat undertow

Priority LOW 37

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02179 Published 2020-01-23 Partial fix · 2.0.28.SP1, 2.0.29.Final CWE-400
TI-2019-07539 CVE-2019-10219 · GHSA-m8p2-495h-ccmh

Cross-site scripting in hibernate-validator

Priority LOW 31

A vulnerability was found in Hibernate-Validator.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02157 Published 2019-11-08 Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79
TI-2020-01644 CVE-2020-1697 · GHSA-8vf3-4w62-m3pq

Cross-site scripting in Red Hat keycloak

Priority LOW 29

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00758 Published 2020-02-10 Partial fix · 9.0.0 CWE-79