Read the docs
Red Hat Security Advisory

RHSA-2022:0155

Red Hat Single Sign-On 7.5.1 security update

Released 2022-01-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2021-17647 CVE-2021-40690 · GHSA-j8wc-gxx9-82hx

Bypass of the secureValidation property

Priority MEDIUM 49

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference e…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07441 Published 2021-09-19 Partial fix · 2.2.3,2.1.7, 2.2.3 +1 CWE-200
TI-2021-03009 CVE-2021-4133 · GHSA-83x4-9cwr-5487

Incorrect authorization in Keycloak

Priority MEDIUM 41

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user regist…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01373 Published 2022-01-25 Fixed in 15.1.1 CWE-863
TI-2021-02758 CVE-2021-3827 · GHSA-4pc7-vqv5-5r3v

Improper authentication in keycloak

Priority LOW 32

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.0111 Published 2022-08-23 Partial fix · 18.0.0 CWE-287