-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 Advisory ID: RHSA-2022:0448-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:0448 Issue date: 2022-02-07 CVE Names: CVE-2021-3859 CVE-2021-4104 CVE-2022-23302 CVE-2022-23305 CVE-2022-23307 ===================================================================== 1. Summary: New Red Hat Single Sign-On 7.5.1 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.4 for RHEL 8 - noarch 3. Description: Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.5.1 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.5.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * undertow: client side invocation timeout raised when calling over HTTP and HTTP2 (CVE-2021-3859) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2010378 - CVE-2021-3859 undertow: client side invocation timeout raised when calling over HTTP2 2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender 2041949 - CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink 2041959 - CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender 2041967 - CVE-2022-23307 log4j: Unsafe deserialization flaw in Chainsaw log viewer 6. JIRA issues fixed (https://issues.jboss.org/): CIAM-1976 - [CVE-2021-3859 (undertow)] RPMs for RH-SSO 7.5.1 ZIP distribution 7. Package List: Red Hat Single Sign-On 7.4 for RHEL 8: Source: rh-sso7-keycloak-15.0.4-1.redhat_00003.1.el8sso.src.rpm noarch: rh-sso7-keycloak-15.0.4-1.redhat_00003.1.el8sso.noarch.rpm rh-sso7-keycloak-server-15.0.4-1.redhat_00003.1.el8sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2021-3859 https://access.redhat.com/security/cve/CVE-2021-4104 https://access.redhat.com/security/cve/CVE-2022-23302 https://access.redhat.com/security/cve/CVE-2022-23305 https://access.redhat.com/security/cve/CVE-2022-23307 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/ 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYgIBhtzjgjWX9erEAQgkpA//T7zN7tGN2disJM9JUjAHkceLRQ7vfJdQ gd5JdOb642BEIzFVRYORYaTtoA6cWioW4LNsX7DALT7BMNOrVf6Yqfywlu9QWA5V LTNMlvvyiYYhVQ3cUbFjEF4F+iww9wGVo6/gvraZ/60rJvbUDz7eAHEuCGEDtEDi YlEmLPNLzfv/lLpjD+cicO//fZCEdFbaWdZwaiMDBMlZB8180feQrMnHClNXKdQj PLLEeM8fig2t/avMOCZUD7bIL4FBNrKZg6KySUfhGzes++kU614/ZlyovBrybvXc +SYie8KyAG9KiOKvmPDIhzfYl/W8qGVPbyJh7A08H6z1Xcu42N+mQxqLtbVF15zH xyNdn7nCTwZ8w2Ar93GUeJbaCWAfuOyI5FXqF0PKCaiYVHpFaZrdyyj6MjgQuqLw spc2qKNNYlYbdcOhiRDhCVhRaMSnrxx+jdmBp0O4Z2JBq/a+k2Q0C3wCzeGIeeti Us5B8ip+iypCT+8wwxy/yC0rG6ADnJ2O16T4npM76sjSPue70kSmoFehsr0MxJLy uZ0PW5OpPAVYgLWrsVFWk6lwM13I9eE7EvQlJ0xrzjdIfWc9HuptL1u6SEcLOi4G t1q2P7b25gfY7CDakYu/10MXQUBOPYuwewMmspSTCIFDFo/KSyqVPhJezcEUIqYC 6aMGC99M6Oo= =btmq -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce