-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Single Sign-On 7.1 update
Advisory ID:       RHSA-2017:0876-01
Product:           Red Hat Single Sign-On
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2017-0876.html
Issue date:        2017-04-04
CVE Names:         CVE-2016-8629 CVE-2016-9589 CVE-2017-2585 
=====================================================================

1. Summary:

Red Hat Single Sign-On 7.1 is now available for download from the Customer
Portal.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat Single Sign-On is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.1 serves as a replacement for Red
Hat Single Sign-On 7.0, and includes several bug fixes and enhancements.
For further information, refer to the Release Notes linked to in the
References section.

Security Fix(es):

* It was found that keycloak did not correctly check permissions when
handling service account user deletion requests sent to the REST server. An
attacker with service account authentication could use this flaw to bypass
normal permissions and delete users in a separate realm. (CVE-2016-8629)

* It was found that JBoss EAP 7 Header Cache was inefficient. An attacker
could use this flaw to cause a denial of service attack. (CVE-2016-9589)

* It was found that keycloak's implementation of HMAC verification for JWS
tokens uses a method that runs in non-constant time, potentially leaving
the application vulnerable to timing attacks. (CVE-2017-2585)

Red Hat would like to thank Gabriel Lavoie (Halogen Software) for reporting
CVE-2016-9589 and Richard Kettelerij (Mindloops) for reporting
CVE-2017-2585.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1388988 - CVE-2016-8629 keycloak: user deletion via incorrect permissions check
1404782 - CVE-2016-9589 wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage
1412376 - CVE-2017-2585 keycloak: timing attack in JWS signature verification

5. References:

https://access.redhat.com/security/cve/CVE-2016-8629
https://access.redhat.com/security/cve/CVE-2016-9589
https://access.redhat.com/security/cve/CVE-2017-2585
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=core.service.rhsso&version=7.1
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.1/html/release_notes/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFY49yzXlSAg2UNWIIRAvTQAJ974qxyhs02FT90yTyfndWoIASXsACgm5j+
WCCEgCaXC8+Q/oUYY4SriRs=
=68Yp
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce