RHSA-2021:0319: Moderate: Red Hat Single Sign-On 7.4.5 security update on RHEL 7
Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.4.5 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.4.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.Security Fix(es): keycloak: Default Client configuration is vulnerable to SSRF using "requesturi" parameter (CVE-2020-10770) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 9.0.11-1.redhat_00001.1.el7 - Upgrade
Upgrade
redhat/rh-sso7-keycloak-serverto a version that resolves this vulnerability.Fixed in 9.0.11-1.redhat_00001.1.el7
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:0319?
The severity of RHSA-2021:0319 is classified as moderate.
How do I fix RHSA-2021:0319?
To fix RHSA-2021:0319, upgrade to Red Hat Single Sign-On 7.4.5 or later.
What software is affected by RHSA-2021:0319?
RHSA-2021:0319 affects the rh-sso7-keycloak and rh-sso7-keycloak-server packages on RHEL 7.
What is Red Hat Single Sign-On 7.4?
Red Hat Single Sign-On 7.4 is a standalone server that provides authentication and single sign-on capabilities for web and mobile applications.
Is RHSA-2021:0319 related to Keycloak?
Yes, RHSA-2021:0319 is based on the Keycloak project.