Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisorymoderateRed HatRed Hat 7.4.7 RHSA-2021:2070-01 Moderate: Single Sign-On Security Fixes
A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Single Sign-On 7.4.7 security update Advisory ID: RHSA-2021:2070-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2021:2070 Issue date: 2021-05-20 CVE Names: CVE-2021-3424 CVE-2021-3461 CVE-2021-21290 CVE-2021-21295 ==================================================================== 1. Summary: A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.4.7 serves as a replacement for Red Hat Single Sign-On 7.4.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * netty: Information disclosure via the local system temporary directory (CVE-2021-21290) * netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295) * keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP (CVE-2021-3461) * keycloak: Internationalized domain name (IDN) homograph attack to impersonate users(CVE-2021-3424) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1927028 - CVE-2021-21290 netty: Information disclosure via the local system temporary directory 1933320 - CVE-2021-3424 keycloak: Internationalized domain name (IDN) homograph attack to impersonate users1937364 - CVE-2021-21295 netty: possible request smuggling in HTTP/2 due missing validation 1941565 - CVE-2021-3461 keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP 5. References: https://access.redhat.com/security/cve/CVE-2021-3424 https://access.redhat.com/security/cve/CVE-2021-3461 https://access.redhat.com/security/cve/CVE-2021-21290 https://access.redhat.com/security/cve/CVE-2021-21295 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.4 https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.4 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYKahltzjgjWX9erEAQhxlBAAo/JqfCqNLqDDvmGEyEfrjOM4xjJrpODp psudtB1aYun6VNfpZO/wdUngZv299EOZAEqPmgVqETVVP975JY6NtH7yn/jczAXe gDo29WHG1rcSOsWmWgpeJYKq2a70X909jShiXjSPYz+g8MSODPHcVYpTA0/gnQl7 AYfmmm9UbX+weVS5vBdk2R0NFR3VPEobhPOSAXDwo5CEew4PQzr/IGDaHglTA5wc xEv2/4Bl+IO4I7QZeFOWeTCVFE3e1OkUe9kQfGCd96oYW/YXXe7IA1ReIMlV/8o9 5JLKDU6JLoGQVzlQ4PRpINxrk2/VzrOQvbL6hT+2T+NsjdOW56mnlUhLEetgfVjA ju1ATrHekp1+sDSvLiWPsQSIljcaZwn9Vq5E7rmLJ/7IqIGGH8wBVW5Vy3764sdU 06aJXuLFeWuUIEsyvObQDy5qmaGA/tVlYbPgEzANVM/TpFuPFdgOFiUjq5+Hy2qH by40ENo0e3qlg5v5Vlgi+4WtyKov0Wkareo5P8KtD/ZdZzLV3knriTmdPSpG6h5A wV5fh1i/bCzWVW/6qNHcg5jPWtc29CEY7Sh182Xf1+esN5eoXia4VRzRhGAIRTkK UofJYaUACkgP5e7G7IM2uJ+uhWUeUZJOOuEXgn4/+FWTJJXn5a/zHOiDFPUUyBEj S2bSBd6lSWE=T4yq -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 20, 2021
•Important
Red Hat
98
security advisorymoderatesecurity updateRed Hat 8 RHSA-2021-2065: Enhancements in Keycloak Session Termination
New Red Hat Single Sign-On 7.4.7 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Single Sign-On 7.4.7 security update on RHEL 8 Advisory ID: RHSA-2021:2065-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2021:2065 Issue date: 2021-05-20 CVE Names: CVE-2021-3424 CVE-2021-3461 ==================================================================== 1. Summary: New Red Hat Single Sign-On 7.4.7 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.4 for RHEL 8 - noarch 3. Description: Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.4.7 serves as a replacement for Red Hat Single Sign-On 7.4.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP (CVE-2021-3461) * keycloak: Internationalized domain name (IDN) homograph attack to impersonate users (CVE-2021-3424) For more details about the security issue(s), including the impact, a CVSS score, and other related information,refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1933320 - CVE-2021-3424 keycloak: Internationalized domain name (IDN) homograph attack to impersonate users1941565 - CVE-2021-3461 keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP 6. Package List: Red Hat Single Sign-On 7.4 for RHEL 8: Source: rh-sso7-keycloak-9.0.13-1.redhat_00006.1.el8sso.src.rpm noarch: rh-sso7-keycloak-9.0.13-1.redhat_00006.1.el8sso.noarch.rpm rh-sso7-keycloak-server-9.0.13-1.redhat_00006.1.el8sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-3424 https://access.redhat.com/security/cve/CVE-2021-3461 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.4/html/release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYKZZ3tzjgjWX9erEAQj3QxAAh/mMhlhioObl0Ko+YnFov7kXVrlgDi1J Bg9HeUqz1jNtDmkIRirX+fXBh3ZBSqWqI96P23YpYKr0oK2vfjOvwv5Vjis1On3q /zeEb9UwJDCGcl4KxOX2RwUPp/DDJZM2xJcF1dTQDaiaZVLKBJIkrD5LwBf57X4l fLvoUt5KaBy+ljiCNJWuk+Tdhq37zPHhzZWZGCjHOlXnuERCk3ktVdXVVShA8EEv o/rsv0vmNBxVC9OnlETUFH0ROGWvu7Y7kOLWyM/y9FmPMWZG7NEZZ3dpQHAiq72C Ketwb4rrbfKSH/5kK10+T5yBQF0J/cTCJsTjMIQdPyZu3PtJrhDxgILVdT4g476W 3kDF2+XtElHjhMWdOdAue9O5K8HcXK60XhKbNreIlQ4K3lSs9TjM9LSyl3O97HK2 EVwD/4gly+MSbOH/X/4bt1VXZ23j8EMhp6OaI9NK36kqlrAcXz76i2qJxg2tMWZT NhOZlfACxPf1LazhHI0BNIMNDgesqJkWtB+J7jpBHI+0sE9ESV3CsHrxg8ezVP0Z u/VlUxsBVNuyNoDtb/jePh/ZwwbeSMpvhpRuTXXv86RQtBON6G4swwzdVbZZwnJs UF8vs8NHuJlGGIxqi/8D3F1BfuTRAZCELKwzel3PY0hTjdLnbi5QzjFAEHwJcxNR IKOcDhodCkc=3Ayj -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 20, 2021
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!