Red Hat Security Advisory

RHSA-2020:5533

Red Hat Single Sign-On 7.4.4 security update

Released 2020-12-15 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2020-15666 CVE-2020-25649 · GHSA-288c-cq4h-88gq

MEDIUM 56

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.17714 Published 2020-12-03 Partial fix · 2.6.7.4, 2.9.10.7 +1 CWE-611

TI-2020-15656 CVE-2020-25638 · GHSA-j8jw-g6fq-mp7h

MEDIUM 40

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.02929 Published 2020-12-02 Partial fix · 5.4.24.Final, 5.3.20.Final CWE-89

TI-2020-10810 CVE-2020-13822 · GHSA-vh7m-p724-62c2

LOW 39

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.02705 Published 2020-06-04 Partial fix · 6.5.3 CWE-190

TI-2020-08596 CVE-2020-10695 · GHSA-8cr8-fvmm-h4p4

LOW 34

An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0025 Published 2021-05-26 Fixed CWE-266

TI-2020-16897 CVE-2020-27826 · GHSA-m9cj-v55f-8x26

LOW 20

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API.

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00572 Published 2021-05-28 Fixed in 12.0.0 CWE-250