Read the docs
Red Hat Security Advisory

RHSA-2021:0327

Red Hat Single Sign-On 7.4.5 security update

Released 2021-02-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2020-08665 CVE-2020-10770 · GHSA-jh7q-5mwf-qvhw

Server-side request forgery in keycloak

Priority MEDIUM 61

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.69724 Published 2020-12-15 Fixed in 13.0.0 CWE-918
TI-2020-10932 CVE-2020-13956 · GHSA-7r82-7xv7-xcpj

Improper input validation in Apache HttpClient

Priority MEDIUM 42

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request executio…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.09032 Published 2020-12-02 Partial fix · 4.5.13, 5.0.3 CWE-20
TI-2020-16867 CVE-2020-27782 · GHSA-rhcw-wjcm-9h6g

Uncontrolled resource consumption in Undertow

Priority LOW 36

A flaw was found in the Undertow AJP connector.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01375 Published 2021-02-23 Partial fix · 2.1.5, 2.0.33 CWE-400
TI-2020-15705 CVE-2020-25689 · GHSA-97hp-6q9g-5cw2

Memory leak in Red Hat wildfly-core

Priority LOW 32

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01487 Published 2020-10-30 Partial fix · 21.0.1 CWE-401
TI-2020-16893 CVE-2020-27822 · GHSA-qx3p-9mmp-4v8h

Memory leak in wildfly

Priority LOW 29

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01122 Published 2020-12-08 Partial fix · 21.0.2.Final, 22.0.0.Beta1 CWE-401
TI-2020-15658 CVE-2020-25640 · GHSA-jw3v-5ch2-wfmm

Information disclosure through error messages in wildfly

Priority LOW 27

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01348 Published 2020-11-24 Partial fix · 21.0.0.Final CWE-209