RHSA-2022:8961: Important: Red Hat Single Sign-On 7.6.1 security update on RHEL 7
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.6.1 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes the security fixes listed below.Security Fix(es): keycloak: path traversal via double URL encoding (CVE-2022-3782) keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:8961?
The severity of RHSA-2022:8961 is classified as critical due to potential exploits.
How do I fix RHSA-2022:8961?
To fix RHSA-2022:8961, upgrade to Red Hat Single Sign-On version 18.0.3-1.redhat_00002.1.el7 or higher.
What vulnerabilities are addressed in RHSA-2022:8961?
RHSA-2022:8961 addresses multiple vulnerabilities in Red Hat Single Sign-On, enhancing security and stability.
What is Red Hat Single Sign-On 7.6?
Red Hat Single Sign-On 7.6 is a standalone server providing authentication and single sign-on capabilities for applications.
Which versions of Red Hat Single Sign-On are affected by RHSA-2022:8961?
RHSA-2022:8961 affects Red Hat Single Sign-On 7.6 running on RHEL 7.