Stay Secure with the Latest Linux Advisories

security advisoryRed HatDoS

Red Hat 7.6.5 RHSA-2023-4918-01 Critical: Jettison DoS Risk

New Red Hat Single Sign-On 7.6.5 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.6.5 security update on RHEL 7 Advisory ID: RHSA-2023:4918-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2023:4918 Issue date: 2023-08-31 CVE Names: CVE-2021-46877 CVE-2023-1436 CVE-2023-3223 ===================================================================== 1. Summary: New Red Hat Single Sign-On 7.6.5 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.6 for RHEL 7 Server - noarch 3. Description: Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.5 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436) * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877) * undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223) For more details about the security issue(s), including the impact, aCVSS score, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2182788 - CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray 2185707 - CVE-2021-46877 jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode 2209689 - CVE-2023-3223 undertow: OutOfMemoryError due to @MultipartConfig handling 6. Package List: Red Hat Single Sign-On 7.6 for RHEL 7 Server: Source: rh-sso7-keycloak-18.0.9-1.redhat_00001.1.el7sso.src.rpm noarch: rh-sso7-keycloak-18.0.9-1.redhat_00001.1.el7sso.noarch.rpm rh-sso7-keycloak-server-18.0.9-1.redhat_00001.1.el7sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-46877 https://access.redhat.com/security/cve/CVE-2023-1436 https://access.redhat.com/security/cve/CVE-2023-3223 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJk8OUyAAoJENzjgjWX9erERWEP+gLEvzsvufdNaC/sSQ/tPV9n vln8UIZfZNwc9OwqbHGRDlUPTu27YFIF59buGdpvX+NJyy1NZ/tgcptC43KYSejX FZSt9veFSEhI15MtG3RCZzbLzv6FXJt5Pvv5d3hc4JBea6l3M3QgpLaf+4W4TUx+ 4eSTHXdSTlfdEpwGCK0KrA18CcjNVFy0XyvMPW4m4LnBdguLKF8KQcHzBO+nZyM5 rQ/oL+SDhGsdnJgThaV6tKNSaw4m3tRuUItF7YUllbBdbEpP06l5MScJ/OQP8kGp 0h/BODeOUFr1tmDLzVXR6BRBUgbkgK73EmJwo6yhylTDjNdvtEhabuBJavZh5UZE BEuaag2W1Yiq3MBsOUnFu9si65zC6mKUfEOVmaSuDNWEmI0FaS6K6FBZZqT3Ek1R QrrU69vleKjmeMmyQzQKqJpdEiCveEzBr7k09YSHUCDkhhWPL9pnASdCSXl7y4E/ cFqpB6aiAUqRlPdPQJxGuSc1HYbVCvJwyEZNuQIbohND6cdsC49pLIoVZ3r2BzQG zRg6F+y+4Ho9KBrYuPpftCLYhxvp2iH1XHwmeG/66nbDUqmRXBKhS5ADcewy0qQL eGUUtWX/UiZWe54CFyQ52h2D9gf7kI1XixpQvvGUMAGyRvJWh5pL/4ynwQbInJyi Rg4JKMmy+faz+x0je4lD =7B/A -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Fresh Red Hat Single Sign-On 7.6.5 updates released for RHEL 7, focusing on critical security improvements and feature upgrades.. Red Hat Single Sign-On, Authentication, Security Update. . Severity: Important. LinuxSecurity.com Team

Aug 31, 2023 •Important Red Hat