-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Single Sign-On 7.4.10 security update Advisory ID: RHSA-2021:5170-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2021:5170 Issue date: 2021-12-15 CVE Names: CVE-2021-3629 CVE-2021-3642 CVE-2021-3717 CVE-2021-20289 CVE-2021-37714 CVE-2021-40690 ===================================================================== 1. Summary: A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.4.10 serves as a replacement for Red Hat Single Sign-On 7.4.9, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629) * wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642) * wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users (CVE-2021-3717) * jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714) * xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690) * resteasy: Error message exposes endpoint class information (CVE-2021-20289) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1935927 - CVE-2021-20289 resteasy: Error message exposes endpoint class information 1977362 - CVE-2021-3629 undertow: potential security issue in flow control over HTTP/2 may lead to DOS 1981407 - CVE-2021-3642 wildfly-elytron: possible timing attack in ScramServer 1991305 - CVE-2021-3717 wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users 1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck 2011190 - CVE-2021-40690 xml-security: XPath Transform abuse allows for information disclosure 5. References: https://access.redhat.com/security/cve/CVE-2021-3629 https://access.redhat.com/security/cve/CVE-2021-3642 https://access.redhat.com/security/cve/CVE-2021-3717 https://access.redhat.com/security/cve/CVE-2021-20289 https://access.redhat.com/security/cve/CVE-2021-37714 https://access.redhat.com/security/cve/CVE-2021-40690 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.4 https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/ https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/html/release_notes/index 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYbpT9NzjgjWX9erEAQhusQ//eo+QOc+UBUMoGhzVZvWE+idyjCw2Y9fW 6AvvUisVgFAcAD5KdnWdsMCgkxDUIiS0iPB+hiLMF1lvJxrjp1E8vrzcJO37u5Iz til/mC+Or+Y6heCxapia1KSqeLjsozOkAE0asKv3u7zYKLB7P4LH9eo3OrA7JRu2 jjJ6Vu2vjhNVe3m31gSJwsHfsvFHp7Azroj6mw3/ykvWj1JpLLbNXcBXgHZAmFKn PS/Qaz5WAd5ltFeDFud5MqeDz2h8BR8S7kKeKpM8VRTcBuCxMLgwkMC27zCP6cJ5 8zlWFqgOzcUKc8Mtq6j7jpTTQcKzLjg56JUdBLgkJt6U5qBIOMVG0wT/DNTJa1Sw O8DeHeEvENUdPOR5Q3xL2go3Y7kvgBWn+aMpHMOwHgCOfO8IF2YAsLF8oTrBDm17 PmzRt8OIzJSXsKotHBOLzBGFVxbrd9EwDQ3r38I/U6GWqr2OtEjWf8M9zcYMr2c/ N/VchRStHjZ9L/6pQP7VTBLgz7Vw3PjON4+GHOGJWmMZEWrjx2m6wyjwFjKsriN2 mIashHk92m9pIpd/aRUpyiUCXpZnf5y+wc47KYqOLynnKYy+/ecXcAxSu8Q740i0 CjUJXMTl0z9NZZO5cZxYKDbgaw5d2cL6/cT9pM69Eiy+0lQA3c61H8vUJt9tHEKE WN813OxlfcE= =BrAp -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce