Red Hat Security Advisory

RHSA-2020:3496

Red Hat Single Sign-On 7.4.2 security update on RHEL 7

Released 2020-08-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.4 for RHEL 7 Server rh-sso7-keycloak-9.0.5-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-9.0.5-1.redhat_00001.1.el7sso

Fixes 2 records

TI-2020-08655 CVE-2020-10758 · GHSA-52rg-hpwq-qp56

Resource allocation without limits in Keycloak

LOW 37

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01947 Published 2020-09-16 Partial fix · 11.0.1 CWE-770

TI-2020-01672 CVE-2020-1728 · GHSA-3gg7-9q2x-79fc

Clickjacking in [UNKNOWN] keycloak

LOW 26

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00783 Published 2020-04-06 Partial fix CWE-358