Red Hat Security Advisory

RHSA-2021:3528

Red Hat Single Sign-On 7.4.9 security update on RHEL 7

Released 2021-09-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.4 for RHEL 7 Server rh-sso7-keycloak-9.0.15-1.redhat_00002.1.el7sso, rh-sso7-keycloak-server-9.0.15-1.redhat_00002.1.el7sso

Fixes 5 records

TI-2020-17296 CVE-2020-28491 · GHSA-xmc8-26q4-qjhx

Denial of service (DoS) in com.fasterxml.jackson.dataformat:jackson-dataformat-cbor

LOW 37

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02417 Published 2021-02-18 Partial fix · 2.11.4, 2.12.1 CWE-770

TI-2021-02582 CVE-2021-3637 · GHSA-2vp8-jv5v-6qh6

Resource allocation without limits in keycloak-model-infinispan

LOW 35

A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01129 Published 2021-07-09 Fixed in 14.0.0 CWE-770

TI-2021-02577 CVE-2021-3632 · GHSA-qpq9-jpv4-6gwr

Improper authentication in keycloak

LOW 35

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01157 Published 2022-08-26 Fixed in 15.1.0 CWE-287

TI-2021-02472 CVE-2021-3513 · GHSA-xv7h-95r7-595j

Insufficiently protected credentials in keycloak

LOW 34

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00795 Published 2022-08-22 Fixed in 13.0.0 CWE-522

TI-2020-18030 CVE-2020-35509 · GHSA-rpj2-w6fr-79hc

Improper input validation in keycloak

LOW 24

A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00352 Published 2022-08-23 Fixed in 14.0.0 CWE-20