Read the docs
Red Hat Security Advisory

RHSA-2020:2112

Red Hat Single Sign-On 7.3.8 security update

Released 2020-05-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 10 records

TI-2020-01662 CVE-2020-1718 · GHSA-j229-2h63-rvh9

Improper authentication in Red Hat keycloak

Priority MEDIUM 40

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01004 Published 2020-05-12 Partial fix · 8.0.0 CWE-287
TI-2020-05834 CVE-2020-7226 · GHSA-x64g-4xx9-fh6x

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products…

Priority LOW 39

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03334 Published 2020-01-24 Partial fix · 1.1.4, 1.2.4 CWE-770
TI-2020-01700 CVE-2020-1757 · GHSA-2w73-fqqj-c92p

Improper input validation in Red Hat undertow

Priority LOW 38

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01615 Published 2020-04-21 Partial fix · 2.1.0 CWE-20
TI-2020-01642 CVE-2020-1695 · GHSA-63cq-ppq8-cw6g

Improper input validation in Red Hat resteasy

Priority LOW 37

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02017 Published 2020-05-19 Partial fix · 4.6.0, 3.12.0 CWE-20
TI-2019-13115 CVE-2019-17573 · GHSA-f93p-f762-vr53

Cross-site scripting in Apache CXF

Priority LOW 37

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.07055 Published 2020-01-16 Partial fix · 3.2.12, 3.3.5 CWE-79
TI-2019-11104 CVE-2019-14900 · GHSA-8grg-q944-cch5

SQL injection in Hibernate

Priority LOW 33

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02126 Published 2020-07-06 Partial fix · 5.3.18, 5.4.18 +1 CWE-89
TI-2020-01701 CVE-2020-1758 · GHSA-c597-f74m-jgc2

Improper certificate validation in Red Hat keycloak

Priority LOW 28

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00928 Published 2020-05-15 Partial fix · 10.0.0 CWE-297
TI-2020-01663 CVE-2020-1719 · GHSA-p9cf-qjxq-vxw6

A flaw was found in wildfly.

Priority LOW 25

A flaw was found in wildfly.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00575 Published 2021-06-07 Partial fix · 20.0.0.Final CWE-270