Red Hat Security Advisory

RHSA-2022:6783

Red Hat Single Sign-On 7.5.3 security update on RHEL 8

Released 2022-10-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-15.0.8-1.redhat_00001.1.el8sso

Fixes 8 records

TI-2021-18806 CVE-2021-42392 · GHSA-h376-j262-vhq6

Deserialization of untrusted data in h2database h2

HIGH 83

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83176 Published 2022-01-07 Partial fix · 2.0.206 CWE-502

TI-2020-18753 CVE-2020-36518 · GHSA-57j2-w4cx-62h2

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of…

MEDIUM 47

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0486 Published 2022-03-11 Partial fix · 2.13.2.1, 2.12.6.1 CWE-787

TI-2022-00035 CVE-2022-0084 · GHSA-76fg-mhrg-fmmg

Resource allocation without limits in xnio

LOW 36

A flaw was found in XNIO, specifically in the notifyReadClosed method.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01583 Published 2022-08-26 Partial fix CWE-770

TI-2022-02467 CVE-2022-2668 · GHSA-wf7g-7h6h-678v

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for…

LOW 34

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01 Published 2022-08-05 Fixed in 19.0.2

TI-2021-19603 CVE-2021-43797 · GHSA-wx5j-54mm-rqqq

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

LOW 34

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02884 Published 2021-12-09 Partial fix · 4.1.71.Final CWE-444

TI-2022-00162 CVE-2022-0225 · GHSA-fqc7-5xxc-ph7r

Cross-site scripting in keycloak

LOW 30

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.032 Published 2022-08-26 Fixed CWE-79

TI-2022-00772 CVE-2022-0866 · GHSA-pjxg-p9c7-7c3v

Incorrect authorization in Wildfly

LOW 26

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00902 Published 2022-05-10 Partial fix CWE-863

TI-2022-02081 CVE-2022-2256 · GHSA-w9mf-83w3-fv49

Cross-site scripting in keycloak

LOW 19

A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00696 Published 2022-09-01 Fixed in 19.0.2 CWE-79