RHSA-2021:0968LowCVSS 5.4
Red Hat Security Advisory: Red Hat Single Sign-On 7.4.6 security update on RHEL 7
🔗 CVE IDs covered (2)
📋 Description
CVE-2020-7676 — nodejs-angular: XSS due to regex-based HTML replacement CVE-2020-14302 — keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks
🎯 Affected products4
- Red Hat Single Sign-On 7.4 for RHEL 7 Server
- rh-sso7-keycloak-0:9.0.12-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.4 for RHEL 7 Server
- rh-sso7-keycloak-0:9.0.12-1.redhat_00001.1.el7sso.src as a component of Red Hat Single Sign-On 7.4 for RHEL 7 Server
- rh-sso7-keycloak-server-0:9.0.12-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.4 for RHEL 7 Server
✅ Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2021:0968
- externalhttps://access.redhat.com/security/updates/classification/#low
- externalhttps://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/html/release_notes/index
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1849206
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1849584
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0968.json