-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: security update of rh-sso-7/sso75 container images for IBM P/Z
Advisory ID:       RHSA-2022:0034-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0034
Issue date:        2022-01-05
CVE Names:         CVE-2021-3712 CVE-2021-4133 CVE-2021-42574 
=====================================================================

1. Summary:

A security update is now available for Red Hat Single Sign-On 7.5 container
images for IBM P/Z.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat Single Sign-On 7.5 container images for IBM P/Z, based on the
Keycloak project, that provides authentication and standards-based single
sign-on capabilities for web and mobile applications.

This is a security update Red Hat Single Sign-On 7.5, and includes one
security fix.

Security Fix:

* keycloak: Incorrect authorization allows unpriviledged users to create
other users (CVE-2021-4133)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

The RHEL-8 based Middleware Containers container image provided by this
update
can be downloaded from the Red Hat Container Registry at
registry.access.redhat.com. Installation instructions for your platform are
available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image
specifically, or to the latest image generally.

4. Bugs fixed (https://bugzilla.redhat.com/):

2033602 - CVE-2021-4133 Keycloak: Incorrect authorization allows unpriviledged users to create other users

5. References:

https://access.redhat.com/security/cve/CVE-2021-3712
https://access.redhat.com/security/cve/CVE-2021-4133
https://access.redhat.com/security/cve/CVE-2021-42574
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYdX13tzjgjWX9erEAQiU7Q/+KTxabnZ2G7/tDEWcYKGufxuf32ssPdN5
pRaB7RgNh2y0EAg3RrcH8GqqG+v0bjEDVYVZ8yh4aJFWQQJc8NDBVxLUzXPPEZZY
GUChwR1pJGXGdS7IJ4XTKqOEcAhMLWosKzk5Glj5xmG46ZAPSm/CJWR1qMjCcdc9
H7AgxsZRV+RYsI5N1roXcYvjbnZEqictX6+nncCsrGFBhav2R5iey7WcamuEceze
24tggcbYNhwfF3OYBRMPRxyPk3vffTQ5x7sQ7KfVIvh15Ki3O+JOuBG3jtw8n83e
V89KY3yJKM2huxzpt72MF+PAEkqTKmuPDchuBVIgzNAg+c/t6k5LOXhTjHGR3jgp
UldqKmVmB+CV3Hrf97DMw+xF/V4upB7WRJjqoPDEP1DN2CRU0DZFnbuVtDaA00jP
5AyKmjNxF4SKyjPkK0DSeamQ///g8dYJO7XKfHKeQI7TMMDHTQkbnbLL1ltizVMa
BPo7a7ft1jX8WPQ19C8bl20z3bcNarxjJUyfgd4NiPl0mG08bGaWNdn3nj7I5Oe3
9xuUgR+rQr2EwAZ4itRWnNcpQl8gECpjDrkKGB3/QWRjjRKSVHPjRZJnrEy2oSXx
F9wsJpCmFcL583KuI47h5qQJiu2pdvuOLv8OTz5DBRn9E3E9NQosulpbj5mdzsOv
EkrjGPohlcE=
=IAwR
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce