Sigurnosni nedostaci programskog paketa Red Hat Single Sign-On

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat Single Sign-On 7.4.3 security update on RHEL 6
Advisory ID: RHSA-2020:4929-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4929
Issue date: 2020-11-04
CVE Names: CVE-2020-10776 CVE-2020-14389
=====================================================================

1. Summary:

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat
Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Single Sign-On 7.4 for RHEL 6 Server – noarch

3. Description:

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.4.3 security update on RHEL 6
serves as a replacement for Red Hat Single Sign-On 7.4.2, and includes bug
fixes and enhancements, which are documented in the Release Notes document
linked to in the References.

Security Fix(es):

* keycloak: user can manage resources with just “view-profile” role using
new Account Console (CVE-2020-14389)

* keycloak: OIDC redirect_uri allows dangerous schemes resulting in
potential XSS (CVE-2020-10776)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1847428 – CVE-2020-10776 keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS
1875843 – CVE-2020-14389 keycloak: user can manage resources with just “view-profile” role using new Account Console

6. Package List:

Red Hat Single Sign-On 7.4 for RHEL 6 Server:

Source:
rh-sso7-keycloak-9.0.9-1.redhat_00001.1.el6sso.src.rpm

noarch:
rh-sso7-keycloak-9.0.9-1.redhat_00001.1.el6sso.noarch.rpm
rh-sso7-keycloak-server-9.0.9-1.redhat_00001.1.el6sso.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-10776
https://access.redhat.com/security/cve/CVE-2020-14389
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX6MB/tzjgjWX9erEAQi+dg//cASCwvgFUGxPLcFYPHnXrJ+FiXX8W2al
GohJQT4FCQa+qqjXnlUP4fm5lDAJ/5IYs/xPpqmct1txBX3o+xnFiLrw1vgmzhNH
coocao5KrxfPjI67CQJrkZplbriA9TBx7IWST7c9iz2vVnim5QOZ/178HxyDfWhW
n3B0B/6/NT8lmpmo5/PQH2MZzgSEfQS5/Lo0GLeN12cZRAuHXissP833jHDT1YVN
ip2nDkVsQP1ekzhd+CS7eGWxc8vakiZ7xPTD+KJWcwndcXWUq/Y1fvnS+9cgLWSJ
ecKXAIrXhuto7pvQ0FYAootd3UZtnCNI2Eb32vbmyIbE/OdGygvoInT+K9xtMb1/
T7fpDN610dpLfNXkOUl3WkrQtkDyISzAeFzVL901E5ZJH07Qsv7EXMjpJrwKSwLJ
Xo2HTLfsp2ikP37FzR6ZpFDo5urQQPvmZf5kJJM5PlSLzbydYRltmPfclkAw7G54
aioIeQ27Q4tQC/n+a49DKnoB7cobfg9J96uC6H50leZ+vc6AAvED2jFeBSLEkfaL
wan47uxWpn6e0u79gOKbbNpX3i5otGzPcKVZL8krTIILCsle3z/Ayvjp+p17NnjY
8g7ynX7fRRVoq85NfpAAAmiy/6cWxyq01OimutuVOB4/HuuAbktHi4nxPXFGa/8V
5+mXQz5ZgBk=
=zr82
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat Single Sign-On 7.4.3 security update on RHEL 8
Advisory ID: RHSA-2020:4932-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4932
Issue date: 2020-11-04
CVE Names: CVE-2020-10776 CVE-2020-14389
=====================================================================

1. Summary:

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat
Enterprise Linux 8.

2. Relevant releases/architectures:

Red Hat Single Sign-On 7.4 for RHEL 8 – noarch, x86_64

3. Description:

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.4.3 security update on RHEL 8
serves as a replacement for Red Hat Single Sign-On 7.4.2, and includes bug
fixes and enhancements, which are documented in the Release Notes document
linked to in the References.

Security Fix(es):

* keycloak: user can manage resources with just “view-profile” role using
new Account Console (CVE-2020-14389)

* keycloak: OIDC redirect_uri allows dangerous schemes resulting in
potential XSS (CVE-2020-10776)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

6. JIRA issues fixed (https://issues.jboss.org/):

KEYCLOAK-15405 – [7.4.z] rh-sso7-libunix-dbus-java rpm missing

7. Package List:

Red Hat Single Sign-On 7.4 for RHEL 8:

Source:
rh-sso7-keycloak-9.0.9-1.redhat_00001.1.el8sso.src.rpm
rh-sso7-libunix-dbus-java-0.8.0-2.el8sso.src.rpm

noarch:
rh-sso7-keycloak-9.0.9-1.redhat_00001.1.el8sso.noarch.rpm
rh-sso7-keycloak-server-9.0.9-1.redhat_00001.1.el8sso.noarch.rpm

x86_64:
rh-sso7-libunix-dbus-java-0.8.0-2.el8sso.x86_64.rpm
rh-sso7-libunix-dbus-java-debuginfo-0.8.0-2.el8sso.x86_64.rpm
rh-sso7-libunix-dbus-java-devel-0.8.0-2.el8sso.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

8. References:

9. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX6MDKtzjgjWX9erEAQjyGQ/+MOOmrUXSEFEPhuM+7MePZ7Q8mYmsfnjD
4Y/D5kSkhtoiUrUgL3Gkf6J9gX5+DbjV490M4gHafqWEknNLfQgfb6Cjj0Eqe552
vYN3DuTRe0JVkBg/4GU2BPXwLfmcVYJ6RqSCXKqkaXz8RvIRp55XAxRQwFIm7no0
NTPBthff+bsJavt3i13gjmhml1GyXixQpTzwSLgC8tFx/0dY4azhlx8hhwXVtTGE
OJBOaejlqQX9A+ISSjH17Kjw2b8MscieEtRmQ+zG3Nnapz5568t3Ayg3kB8lhyhI
L0EXQDItOnOpBb7pvKrdmKqMIdhFfgeooFzsptzG8EhcgrXSVeT8bglbBDDS95nH
EJkMy49BAdAujf1df/0SSkPvTFz9t5Z+DXedKrtZepwl/eZWLTJCM+qfIZSPuIif
TPxsKPu+5jn+Wb9ybR8zRWsoiTphJL/9IWJIWy3DqqOhhKOrUEGWOaiz8Ww7WuDT
Q8KQs4ShvWOcJQGTdoyKjK6rjYpBGefrKaGmO42Yhsej0GuYqdRMpIPpfw7lhBW3
W1g+BdnP3lANlX24aUGYXLK9fIulA0CC91YRzQEmhv4WEOwG9xortJMV9gunuHzC
JZIpgPYaj3esQylFkaZREr+oo5C+zxEmoV7C5umRsdu4JZUphSmCl95o7O3LQBtt
EeZQwDBTJuo=
=1C5v
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat Single Sign-On 7.4.3 security update on RHEL 7
Advisory ID: RHSA-2020:4930-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4930
Issue date: 2020-11-04
CVE Names: CVE-2020-10776 CVE-2020-14389
=====================================================================

1. Summary:

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat
Enterprise Linux 7.

2. Relevant releases/architectures:

Red Hat Single Sign-On 7.4 for RHEL 7 Server – noarch

3. Description:

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.4.3 security update on RHEL 7
serves as a replacement for Red Hat Single Sign-On 7.4.2, and includes bug
fixes and enhancements, which are documented in the Release Notes document
linked to in the References.

Security Fix(es):

* keycloak: user can manage resources with just “view-profile” role using
new Account Console (CVE-2020-14389)

* keycloak: OIDC redirect_uri allows dangerous schemes resulting in
potential XSS (CVE-2020-10776)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

6. Package List:

Red Hat Single Sign-On 7.4 for RHEL 7 Server:

Source:
rh-sso7-keycloak-9.0.9-1.redhat_00001.1.el7sso.src.rpm

noarch:
rh-sso7-keycloak-9.0.9-1.redhat_00001.1.el7sso.noarch.rpm
rh-sso7-keycloak-server-9.0.9-1.redhat_00001.1.el7sso.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX6MCGNzjgjWX9erEAQgO4g//YCbl639iQvYbfXwWrf8M5j3NoKUFy2hR
7RbcDwJB3VduLMVm50iqmsMXqavIp7GmtGFOc7bQz/gUDHkyENrGfNu8EJafCZFt
P4u3jJmiCWoqQhN8g6KczyIVJkIRU11uAWCf79odzI+DYUvcVYekcdUNtxmOjcsD
58QOMmdIzoXF8kIb5a1n7pUZtJKnf0yEOcyCRR6yNL/onmh7iXCuOetVQHoCA5Zf
sXuPzfRVjhGFrlXnt9Ij1lxc41ydsqJBCilvOcjlwLhDuU0J6zDu07LOBBOpNFZV
+h++SsdcOZrgGYG1XBDc+n+k+D3mLUVXeuMESSwSQF2NSK9GJto9hiFMQz3EHN64
/7yQSbqlDf0+/I4YByCUrjaxf4jlOXZtImv7zL4qLdZFEvacHoG/JEj4Cs/OtKVs
td0chwzVOag+jgOLzw99PZTqZQTth2zfXxFAFcWDa1ksu/VMbRxv8rcPL7bmBZIv
XbJpwvN1lyfFauvm4mfEYTI7o9TqFp009NbZF/vjX+NfpZkO2WIaIzfVMTp4z6PV
rik/m0qBE1vUMGXnkpFVAWwT9C5/e+dxWE03A8VRdJ6FsapNhZFpt6xIrIzQRi07
871n7fkagaTzp74OG47oWWBsOmPCKj4wtUNyPqffIljYe6VuJzVVRTQaapUwOvZs
G23ZjEfirDw=
=QfTt
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat Single Sign-On 7.4.3 security update
Advisory ID: RHSA-2020:4931-01
Product: Red Hat Single Sign-On
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4931
Issue date: 2020-11-04
CVE Names: CVE-2020-1954 CVE-2020-10776 CVE-2020-14299
CVE-2020-14338 CVE-2020-14340 CVE-2020-14389
=====================================================================

1. Summary:

A security update is now available for Red Hat Single Sign-On 7.4 from the
Customer Portal.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.4.3 serves as a replacement for
Red Hat Single Sign-On 7.4.2, and includes bug fixes and enhancements,
which are documented in the Release Notes document linked to in the
References.

Security Fix(es):

* picketbox: JBoss EAP reload to admin-only mode allows authentication
bypass (CVE-2020-14299)

* wildfly: XML validation manipulation due to incomplete application of
use-grammar-pool-only in xercesImpl (CVE-2020-14338)

* xnio: file descriptor leak caused by growing amounts of NIO Selector file
handles may lead to DoS (CVE-2020-14340)

* keycloak: user can manage resources with just “view-profile” role using
new Account Console (CVE-2020-14389)

* cxf: JMX integration is vulnerable to a MITM attack (CVE-2020-1954)

* keycloak: OIDC redirect_uri allows dangerous schemes resulting in
potential XSS (CVE-2020-10776)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1824301 – CVE-2020-1954 cxf: JMX integration is vulnerable to a MITM attack
1847428 – CVE-2020-10776 keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS
1848533 – CVE-2020-14299 picketbox: JBoss EAP reload to admin-only mode allows authentication bypass
1860054 – CVE-2020-14338 wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl
1860218 – CVE-2020-14340 xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS
1875843 – CVE-2020-14389 keycloak: user can manage resources with just “view-profile” role using new Account Console

5. References:

https://access.redhat.com/security/cve/CVE-2020-1954
https://access.redhat.com/security/cve/CVE-2020-10776
https://access.redhat.com/security/cve/CVE-2020-14299
https://access.redhat.com/security/cve/CVE-2020-14338
https://access.redhat.com/security/cve/CVE-2020-14340
https://access.redhat.com/security/cve/CVE-2020-14389
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.4
https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBX6MAHdzjgjWX9erEAQg8hw//Xh9pKxtbqpJsu8pmmN+wkcDmJWlB/Bsk
u/kqL5ujUMPw3D+g9blvu5kahSNslhtE7eF9+wPderPoQqtzCs2CwMO6e4Ea0MS5
+BbO6oERnjKmKZOFyPxPJ7iKSsSRvO9+XNFjOJdy+Br2umzPEZ0vx3TaIp35m4Wk
QAJXbPtSuZ9b/ZEWI2EBzXHUBaHxl1BdF8fWRsmJHwOU0EHfualkafa/SpP5bkyJ
GhKLNq6JYo9pxQ2TzLh1TEjfsTZ8qteDuJtQoQeW8u8HStam8NbXMBKVdLY180hA
cxbnKEp7peB7zhqZ2m3vy/HLqXzpB7wdpCAa4VQk5wFYGx4M/taGfbGoeikLWvZ8
xCNEh2ZGKcHBANon2Z+sOCJUfdPwNmK5crhTqz7qrdRUhkjKwVHvx/QLj3ZXrKa8
4PEzmyJ3/oExctteFjWT1LYBmKXp9O2A7vb8pEKzUkSywmRwb4NShekd/oYosjLO
aGvE5QcjIOEJXED6GQ1oSpgR2Sfg1JLYS+FyRHeQWuTrb1h0EFWUZmhpxvGh43/E
J3MCHlEGCPYSOw+xWArCK8U4awywtICfDYMPk7YuPkODJ2v8ysHuNCSul1O2PiD+
I3M99OmdKVOqE6cFXFf9HVLUGgW/vTXciQE4ovITEoM8NM6AWfkmhGpDR6IbdpLn
VnfnMrpXY2M=
=sxK6
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Sigurnosni nedostaci programskog paketa Red Hat Single Sign-On

Archives

More in Preporuke

Sigurnosni nedostaci programskog paketa trousers