Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat Enterprise Linux 8: RHSA-2019-4042-01 Important Red Hat SSO Update

red hat
Calendar Grey December 2, 2019
Dist Redhat Esm H88
Red Hat Identity Management 7.3.5 security patch for RHEL 8 tackles critical vulnerabilities and improvements for software packages.
New Red Hat Single Sign-On 7.3.5 packages are now available for Red Hat Enterprise Linux 8

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.3.5 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: Service accounts reset password flow not using placeholder.org domain anymore (CVE-2019-14837)
* undertow: HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)
* undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)
* undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)
* wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default (CVE-2019-14838)
* wildfly: wildfly-security-manager: security manager authorization bypass (CVE-2019-14843)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory security update red hat important single sign-on rhel

References

https://access.redhat.com/security/cve/CVE-2019-9512 https://access.redhat.com/security/cve/CVE-2019-9514 https://access.redhat.com/security/cve/CVE-2019-9515 https://access.redhat.com/security/cve/CVE-2019-14837 https://access.redhat.com/security/cve/CVE-2019-14838 https://access.redhat.com/security/cve/CVE-2019-14843 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/

Package List

Red Hat Single Sign-On 7.3 for RHEL 8:
Source: rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el8sso.src.rpm
noarch: rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el8sso.noarch.rpm rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el8sso.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2019:4042-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4042
Issue date: 2019-12-02

Topic

New Red Hat Single Sign-On 7.3.5 packages are now available for Red HatEnterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security update red hat important single sign-on rhel

Relevant Releases Architectures

Red Hat Single Sign-On 7.3 for RHEL 8 - noarch

Bugs Fixed

1730227 - CVE-2019-14837 keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure

1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth

1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth

1735745 - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth

1751227 - CVE-2019-14838 wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

1752980 - CVE-2019-14843 wildfly-security-manager: security manager authorization bypass

6. JIRA issues fixed (https://redhat.atlassian.net/jira/projects):

KEYCLOAK-11817 - Tracker bug for the RH-SSO 7.3.5 release for RHEL8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here