RHSA-2021:3534: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.9 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.4.9 serves as a replacement for Red Hat Single Sign-On 7.4.8, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es):

• undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)
• jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception (CVE-2020-28491)
• keycloak: Brute force attack is possible even after the account lockout (CVE-2021-3513)
• undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597)
• keycloak: Anyone can register a new device when there is no device registered for passwordless login (CVE-2021-3632)
• keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly could lead to a DoS attack (CVE-2021-3637)
• jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)
• apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)
• keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity (CVE-2020-35509)
• wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Related CVEs:
• CVE-2020-28491: jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception
• CVE-2020-35509: keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity
• CVE-2021-3513: keycloak: Brute force attack is possible even after the account lockout
• CVE-2021-3597: undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS
• CVE-2021-3632: keycloak: Anyone can register a new device when there is no device registered for passwordless login
• CVE-2021-3637: keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly could lead to a DoS attack
• CVE-2021-3644: wildfly-core: Invalid Sensitivity Classification of Vault Expression
• CVE-2021-3690: undertow: buffer leak on incoming websocket PONG message may lead to DoS
• CVE-2021-28170: jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
• CVE-2021-29425: apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6