Alerts This Week
Warning Icon 1 929
Alerts This Week
Warning Icon 1 929

Red Hat: RHSA-2021-0974 moderate: Single Sign-On 7.4.6 Security Update

red hat
Calendar Grey March 23, 2021
Dist Redhat Esm H88
Important security enhancement for Red Hat Single Sign-On version 7.4.6, comprising multiple resolutions to identified vulnerabilities.
A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).

Summary

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.4.6 serves as a replacement for Red Hat Single Sign-On 7.4.5, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)
* nodejs-angular: XSS due to regex-based HTML replacement (CVE-2020-7676)
* jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client (CVE-2020-35510)
* undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)
* wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client (CVE-2021-20250)
* guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908)
* keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks (CVE-2020-14302)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat XSS bug fix authentication information disclosure password bypass EJP client

References

https://access.redhat.com/security/cve/CVE-2020-7676 https://access.redhat.com/security/cve/CVE-2020-8908 https://access.redhat.com/security/cve/CVE-2020-14302 https://access.redhat.com/security/cve/CVE-2020-28052 https://access.redhat.com/security/cve/CVE-2020-35510 https://access.redhat.com/security/cve/CVE-2021-20220 https://access.redhat.com/security/cve/CVE-2021-20250 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.4 https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.4

Package List


Advisory ID: RHSA-2021:0974-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2021:0974
Issue date: 2021-03-23

Topic

A security update is now available for Red Hat Single Sign-On 7.4 from theCustomer Portal.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat XSS bug fix authentication information disclosure password bypass EJP client

Relevant Releases Architectures

Bugs Fixed

1849206 - CVE-2020-7676 nodejs-angular: XSS due to regex-based HTML replacement

1849584 - CVE-2020-14302 keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks

1905796 - CVE-2020-35510 jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client

1906919 - CVE-2020-8908 guava: local information disclosure via temporary directory created with unsafe permissions

1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

1923133 - CVE-2021-20220 undertow: Possible regression in fix for CVE-2020-10687

1929479 - CVE-2021-20250 wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here