-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Single Sign-On 7.6.1 security update on RHEL 9 Advisory ID: RHSA-2022:7411-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:7411 Issue date: 2022-11-03 CVE Names: CVE-2020-36518 CVE-2021-42392 CVE-2021-43797 CVE-2022-0084 CVE-2022-0225 CVE-2022-0866 CVE-2022-2668 ==================================================================== 1. Summary: New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.6 for RHEL 9 - noarch, x86_64 3. Description: Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.1 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518) * h2: Remote Code Execution in Console (CVE-2021-42392) * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797) * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084) * keycloak: Stored XSS in groups dropdown (CVE-2022-0225) * wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled (CVE-2022-0866) * keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console (CVE-2022-2668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2031958 - CVE-2021-43797 netty: control chars in header names may lead to HTTP request smuggling 2039403 - CVE-2021-42392 h2: Remote Code Execution in Console 2040268 - CVE-2022-0225 keycloak: Stored XSS in groups dropdown 2060929 - CVE-2022-0866 wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled 2064226 - CVE-2022-0084 xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr 2064698 - CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects 2115392 - CVE-2022-2668 keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console 6. Package List: Red Hat Single Sign-On 7.6 for RHEL 9: Source: rh-sso7-1-5.el9sso.src.rpm rh-sso7-javapackages-tools-6.0.0-7.el9sso.src.rpm rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el9sso.src.rpm noarch: rh-sso7-javapackages-filesystem-6.0.0-7.el9sso.noarch.rpm rh-sso7-javapackages-tools-6.0.0-7.el9sso.noarch.rpm rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el9sso.noarch.rpm rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el9sso.noarch.rpm rh-sso7-python3-javapackages-6.0.0-7.el9sso.noarch.rpm x86_64: rh-sso7-1-5.el9sso.x86_64.rpm rh-sso7-runtime-1-5.el9sso.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-36518 https://access.redhat.com/security/cve/CVE-2021-42392 https://access.redhat.com/security/cve/CVE-2021-43797 https://access.redhat.com/security/cve/CVE-2022-0084 https://access.redhat.com/security/cve/CVE-2022-0225 https://access.redhat.com/security/cve/CVE-2022-0866 https://access.redhat.com/security/cve/CVE-2022-2668 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/articles/11258 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY2QOpdzjgjWX9erEAQgqaw//W7XU4kQlMmbyq51m0uk45q6HXebAGM1b EdbEbNeoCvx1/fqLATPUjZvtptwFB8zl8emf9bJzhjFHK1p4rEc/N+1aqAOcwwA6 mUSp7KGGkz2RMpLabqM/3ayAzlngS68OAvg6LnL14SROKHduyn6DDtqW4RzuEbcM rex4Eo9Yv5R4VvRo1YHWsZBqEOjY1FNxchFJVJcR6+0wzvwFvUjgytXbQsVcGTzS x4Ngg30XgCpyTgR1Wim6WOP+snVAPeGZu02f2GqvQNALK4gtR18oRebQs38aq4lV F1eViNL2rBkjKsiD2RoatOojFhmik4r/WcxtRAzoGoPSxnydr6C+DSTVkaBqMKcT zChUY8fXvdcHARFwblSyU48L2yPFYWUGuYW5lGQlj7RO9QWuFAhGP8d6AHKzYDxX Wcv9zrdb2FYEdBPBOP4VYqC120YFSa7Oq0/dNz2yy7JQcK3m5+9QL5m+GXGCziFe E4O1ckEBSytEva5rrA4Kzvmvg++i7IDYWDFaO1lnzsy2zuJTcJdpQcVimbrJDC3x Ffq6y9K5r78OnnjkzYQi3f5D0zIdAKExZkRQL29OL37w5+90WL+JR0PLvZexd4V8 caA0zzXWdoHD4yHj/lFCuqw31VP2pjt/i1G4ViFuNOEmnNRZLlIEtCm2tacwXvk6 8Yk1zMT4ivQ=7G1M -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce