Read the docs
Red Hat Security Advisory

RHSA-2020:2366

Red Hat support for Spring Boot 2.1.12 security and bug fix update

Released 2020-06-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2019-00175 CVE-2019-0199 · GHSA-qcxh-w3j9-58qr

Uncontrolled resource consumption in Apache Tomcat

Priority HIGH 71

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.72855 Published 2019-04-10 Partial fix · 9.0.16, 8.5.38 CWE-400
TI-2019-07520 CVE-2019-10199 · GHSA-p5xp-6vpf-jwvh

Cross-site request forgery in Red Hat keycloak

Priority LOW 39

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00495 Published 2019-08-14 Partial fix · 7.0.0 CWE-352
TI-2019-07522 CVE-2019-10201 · GHSA-4fgq-gq9g-3rw7

Improper signature verification in Red Hat keycloak

Priority LOW 36

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00714 Published 2019-08-14 Partial fix · 7.0.0 CWE-592
TI-2019-11037 CVE-2019-14832 · GHSA-8prc-58j4-m55q

Incorrect authorization in keycloak REST API

Priority LOW 34

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0054 Published 2019-10-15 Partial fix · 7.0.1 CWE-863
TI-2019-02878 CVE-2019-3868 · GHSA-gc52-xj6p-9pxp

Information disclosure in Red Hat keycloak

Priority LOW 20

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC.

CVSS 3.0LOW 3.8 Network High privileges No interaction EPSS 0.01005 Published 2019-04-24 Partial fix · 6.0.0 CWE-200