Red Hat Security Advisory

RHSA-2021:3534

Red Hat Single Sign-On 7.4.9 security update

Released 2021-09-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.4.9

Fixes 10 records

TI-2021-10139 CVE-2021-29425 · GHSA-gwrp-pvrq-jmwv

Possible limited path traversal vulnerabily in Apache Commons IO

MEDIUM 48

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.10549 Published 2021-04-13 Partial fix · 2.7 CWE-20

TI-2020-17296 CVE-2020-28491 · GHSA-xmc8-26q4-qjhx

Denial of service (DoS) in com.fasterxml.jackson.dataformat:jackson-dataformat-cbor

LOW 37

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02417 Published 2021-02-18 Partial fix · 2.11.4, 2.12.1 CWE-770

TI-2021-02626 CVE-2021-3690 · GHSA-fj7c-vg2v-ccrm

Uncontrolled resource consumption in undertow

LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01774 Published 2022-08-23 Partial fix · 2.0.40, 2.2.10 CWE-400

TI-2021-02582 CVE-2021-3637 · GHSA-2vp8-jv5v-6qh6

Resource allocation without limits in keycloak-model-infinispan

LOW 35

A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01129 Published 2021-07-09 Fixed in 14.0.0 CWE-770

TI-2021-02577 CVE-2021-3632 · GHSA-qpq9-jpv4-6gwr

Improper authentication in keycloak

LOW 35

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01157 Published 2022-08-26 Fixed in 15.1.0 CWE-287

TI-2021-02472 CVE-2021-3513 · GHSA-xv7h-95r7-595j

Insufficiently protected credentials in keycloak

LOW 34

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00795 Published 2022-08-22 Fixed in 13.0.0 CWE-522

TI-2021-02544 CVE-2021-3597 · GHSA-mfhv-gwf8-4m88

Race condition in undertow

LOW 29

A flaw was found in undertow.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01161 Published 2022-05-24 Partial fix · 2.2.9.Final, 2.0.39.Final CWE-362

TI-2021-09399 CVE-2021-28170 · GHSA-v6w3-2prq-h95f

Improper input validation in Eclipse Foundation Jakarta Expression Language Implementation

LOW 28

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02132 Published 2021-05-26 Partial fix · 3.0.4 CWE-20

TI-2020-18030 CVE-2020-35509 · GHSA-rpj2-w6fr-79hc

Improper input validation in keycloak

LOW 24

A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00352 Published 2022-08-23 Fixed in 14.0.0 CWE-20

TI-2021-02589 CVE-2021-3644 · GHSA-w88m-2936-rmxr

Information disclosure in wildfly-core

LOW 18

A flaw was found in wildfly-core in all versions.

CVSS 3.1LOW 3.3 Network High privileges No interaction EPSS 0.00982 Published 2022-08-26 Partial fix · 16.0.1.Final, 17.0.0.Beta3 CWE-200