Discover Government News

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Single Sign-On 7.4.3 one-off security update
Advisory ID:       RHSA-2020:5254-01
Product:           Red Hat Single Sign-On
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:5254
Issue date:        2020-11-30
CVE Names:         CVE-2020-25638 
====================================================================
1. Summary:

A security update is now available for Red Hat Single Sign-On 7.4 from the
Customer Portal.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

Security Fix:

* hibernate-core: SQL injection vulnerability when both
hibernate.use_sql_comments and JPQL String literals are used
(CVE-2020-25638)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

5. References:

https://access.redhat.com/security/cve/CVE-2020-25638
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBX8UsKtzjgjWX9erEAQjMoA/9G0NW2aspAsrGscuW9xoKQ3rcro8U7EX2
SGh3yvFH6Euz9NVBHO8Z4ATJZBeRSm54iiFV8KxJUWPRaALGN44ZwoYFfixmP6QJ
4AWziWDxXXJvO7X5kqUUgFRkSBgx38oGC0lXSWXWGyn/2j6sY70YuQxxlsBQWLdM
DoyNq9fsBLJucZOsjVmgSt0pdKMlzb7nBWOhTkCWJiny5FzSimwLMFQSP4GJapiD
333gE8TGfiJ7Kmmp/zBn3xS7B6pLB4ip+dpHLUNoTPEO7MU8RCy4CRXF6C5pqcmB
at9q4QOvYoPmJvMjS+WNoiOSHUvFSnYWbji3UCfhXu/F3/3nHHZPtbWiExigLEzI
QKRlM97fxNyImrVwYT46o8TLQBVsZQLSujx3DOvoeub9hlZnZ0EHDqg47ih08Wtn
A8iMDUrQfwhNHbi/Co6kJjj26CBqH04KkoP3qceOCdvY3CecqA2yQH9TD3dFolFH
W8+nGmPp0IJ7pdZLMh8c4noXPnlhVNeE9l6KQKxzFqmvuy2EzoCAE4wvf3UG/zeB
mKw7UCXFZRAUp1yZyZ7fSPMRmheWYO1yLZBuXWOp3LJvfWrgsRzPW19W2vEQOKxQ
9ayEUX/yfgX3FsEaR2uPjEVQ1+fVID5TmOWYbxNkZx3hcre87XmDZ+ry9oOeQlYL
0tS/7/hLEqc=Iue6
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2020-5254:01 Important: Red Hat Single Sign-On 7.4.3 one-off

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal

Summary

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
Security Fix:
* hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used (CVE-2020-25638)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).

References

https://access.redhat.com/security/cve/CVE-2020-25638 https://access.redhat.com/security/updates/classification/#important

Package List


Severity
Advisory ID: RHSA-2020:5254-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2020:5254
Issued Date: : 2020-11-30
CVE Names: CVE-2020-25638

Topic

A security update is now available for Red Hat Single Sign-On 7.4 from theCustomer Portal.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures


Bugs Fixed

1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used


Related News