Red Hat Security Advisory

RHSA-2020:4932

Red Hat Single Sign-On 7.4.3 security update on RHEL 8

Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.4 for RHEL 8 rh-sso7-keycloak-9.0.9-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-9.0.9-1.redhat_00001.1.el8sso, rh-sso7-libunix-dbus-java-0.8.0-2.el8sso +1

Fixes 2 records

TI-2020-11257 CVE-2020-14389 · GHSA-c9x9-xv66-xp3v

Improper privilege management in keycloak

LOW 37

It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to h…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00822 Published 2020-11-17 Fixed in 12.0.0 CWE-916

TI-2020-08671 CVE-2020-10776 · GHSA-484q-784p-8m5h

Cross-site scripting in keycloak

LOW 23

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00778 Published 2020-11-17 Fixed in 12.0.0 CWE-79