Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Red Hat RHSA-2022:1713-01 Moderate: rh-sso-7 Image Security Update

red hat
Calendar Grey May 4, 2022
Dist Redhat Esm H88
The latest security bulletin addresses moderate vulnerabilities linked to the rh-sso-7 container image, underscoring essential patches and enhancements.
Security updated rh-sso-7/sso75-openshift-rhel8 container image is now available for RHEL-8 based Middleware Containers

Solution

The RHEL-8 based Middleware Containers container image provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.

Summary

The rh-sso-7/sso75-openshift-rhel8 container image has been updated for RHEL-8 based Middleware Containers to include the following security issues.
Security Fix(es):
* keycloak: Privilege escalation vulnerability on Token Exchange (CVE-2022-1245)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Users of rh-sso-7/sso75-openshift-rhel8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.
You can find images updated by this advisory in Red Hat Container Catalog (see References).

Topics%20covered

Topics Covered

security advisory moderate Red Hat Privilege Escalation Container Security Middleware

References

https://access.redhat.com/security/cve/CVE-2018-25032 https://access.redhat.com/security/cve/CVE-2022-1154 https://access.redhat.com/security/cve/CVE-2022-1245 https://access.redhat.com/security/cve/CVE-2022-1271 https://access.redhat.com/security/cve/CVE-2022-21426 https://access.redhat.com/security/cve/CVE-2022-21434 https://access.redhat.com/security/cve/CVE-2022-21443 https://access.redhat.com/security/cve/CVE-2022-21476 https://access.redhat.com/security/cve/CVE-2022-21496 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/security/cve/cve-2022-1245 https://access.redhat.com/containers/?tab=images#/registry.access.redhat.com/rh-sso-7/sso75-openshift-rhel8 https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html/release_notes/index

Package List


Advisory ID: RHSA-2022:1713-01
Product: Red Hat OpenShift Enterprise
Advisory URL: https://access.redhat.com/errata/RHSA-2022:1713
Issue date: 2022-05-04

Topic

Security updated rh-sso-7/sso75-openshift-rhel8 container image is nowavailable for RHEL-8 based Middleware Containers.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat Privilege Escalation Container Security Middleware

Relevant Releases Architectures

Bugs Fixed

2071036 - CVE-2022-1245 keycloak: Privilege escalation vulnerability on Token Exchange

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here