Red Hat Security Advisory

RHSA-2022:7417

Red Hat Single Sign-On 7.6.1 security update

Released 2022-11-03 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Single Sign-On 7.6.1

Fixes 11 records

TI-2021-18806 CVE-2021-42392 · GHSA-h376-j262-vhq6

Deserialization of untrusted data in h2database h2

HIGH 83

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83176 Published 2022-01-07 Partial fix · 2.0.206 CWE-502

TI-2021-18855 CVE-2021-42575 · GHSA-3w73-fmf3-hg5c

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies…

MEDIUM 47

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02975 Published 2021-10-18 Fixed in 20211018.1 CWE-20

TI-2020-18753 CVE-2020-36518 · GHSA-57j2-w4cx-62h2

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of…

MEDIUM 47

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0486 Published 2022-03-11 Partial fix · 2.13.2.1, 2.12.6.1 CWE-787

TI-2022-07892 CVE-2022-23913 · GHSA-pr38-qpxm-g88x

Apache ActiveMQ Artemis DoS

LOW 38

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0274 Published 2022-02-04 Partial fix · 2.20.0, 2.19.1 CWE-770

TI-2022-01201 CVE-2022-1319 · GHSA-5r46-q4x7-6fx6

A flaw was found in Undertow.

LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01696 Published 2022-08-31 Partial fix CWE-252

TI-2022-00759 CVE-2022-0853 · GHSA-f67w-c9w2-5v69

Memory leak in jboss-client

LOW 36

A flaw was found in JBoss-client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01452 Published 2022-03-11 Partial fix CWE-401

TI-2022-00035 CVE-2022-0084 · GHSA-76fg-mhrg-fmmg

Resource allocation without limits in xnio

LOW 36

A flaw was found in XNIO, specifically in the notifyReadClosed method.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01583 Published 2022-08-26 Partial fix CWE-770

TI-2022-02467 CVE-2022-2668 · GHSA-wf7g-7h6h-678v

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for…

LOW 34

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01 Published 2022-08-05 Fixed in 19.0.2

TI-2021-19603 CVE-2021-43797 · GHSA-wx5j-54mm-rqqq

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

LOW 34

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02884 Published 2021-12-09 Partial fix · 4.1.71.Final CWE-444

TI-2022-00162 CVE-2022-0225 · GHSA-fqc7-5xxc-ph7r

Cross-site scripting in keycloak

LOW 30

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.032 Published 2022-08-26 Fixed CWE-79

TI-2022-00772 CVE-2022-0866 · GHSA-pjxg-p9c7-7c3v

Incorrect authorization in Wildfly

LOW 26

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00902 Published 2022-05-10 Partial fix CWE-863