Red Hat Security Advisory

RHSA-2021:2070

Red Hat Single Sign-On 7.4.7 security update

Released 2021-05-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.4.7

Fixes 4 records

TI-2021-04395 CVE-2021-21295 · GHSA-wm47-8v5p-wjpj

Possible request smuggling in HTTP/2 due missing validation

MEDIUM 50

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.18891 Published 2021-03-09 Partial fix · 4.1.60.Final CWE-444

TI-2021-04390 CVE-2021-21290 · GHSA-5mcr-gq6c-3hq2

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

LOW 31

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.01799 Published 2021-02-08 Partial fix · 4.1.59.Final CWE-378

TI-2021-02425 CVE-2021-3461 · GHSA-cm29-6wx7-p874

Insufficient session expiration in keycloak

LOW 31

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00297 Published 2022-04-01 Fixed in 14.0.0 CWE-613

TI-2021-02388 CVE-2021-3424 · GHSA-pf38-cw3p-22q9

Improper authentication in keycloak

LOW 25

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00774 Published 2021-06-01 Fixed in 18.0.0 CWE-287