RHSA-2022:8962: Important: Red Hat Single Sign-On 7.6.1 security update on RHEL 8
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.6.1 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes the security fixes listed below.Security Fix(es): keycloak: path traversal via double URL encoding (CVE-2022-3782) keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:8962?
The severity of RHSA-2022:8962 is classified as important.
How do I fix RHSA-2022:8962?
To fix RHSA-2022:8962, upgrade to the version 18.0.3-1.redhat_00002.1.el8 of rh-sso7-keycloak or rh-sso7-keycloak-server package.
What vulnerabilities are addressed in RHSA-2022:8962?
RHSA-2022:8962 addresses security vulnerabilities related to authentication and single sign-on functionalities.
Is there a workaround for RHSA-2022:8962?
There are currently no known workarounds for the vulnerabilities addressed by RHSA-2022:8962.
Who is affected by RHSA-2022:8962?
RHSA-2022:8962 affects users of Red Hat Single Sign-On 7.6 running on RHEL 8.