Red Hat Security Advisory

RHSA-2020:2107

Red Hat Single Sign-On 7.3.8 security update on RHEL 7

Released 2020-05-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.20-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.20-1.Final_redhat_00001.1.el7sso

Fixes 3 records

TI-2020-01662 CVE-2020-1718 · GHSA-j229-2h63-rvh9

Improper authentication in Red Hat keycloak

MEDIUM 40

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01004 Published 2020-05-12 Partial fix · 8.0.0 CWE-287

TI-2020-01701 CVE-2020-1758 · GHSA-c597-f74m-jgc2

Improper certificate validation in Red Hat keycloak

LOW 28

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00928 Published 2020-05-15 Partial fix · 10.0.0 CWE-297

TI-2020-01668 CVE-2020-1724 · GHSA-8xj2-47xw-q78c

Insufficient session expiration in Red Hat keycloak

LOW 22

A flaw was found in Keycloak in versions before 9.0.2.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00822 Published 2020-05-11 Partial fix · 9.0.2 CWE-613