RHSA-2022:8965: Important: Red Hat Single Sign-On 7.6.1 security update
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.<br>This release of Red Hat Single Sign-On 7.6.1 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes the following security fixes.<br>Security Fix(es):<br><li> keycloak: path traversal via double URL encoding (CVE-2022-3782)</li> <li> keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:8965?
The vulnerability RHSA-2022:8965 is classified as important.
How do I fix RHSA-2022:8965?
To mitigate RHSA-2022:8965, users should upgrade to Red Hat Single Sign-On 7.6.1.
What applications are affected by RHSA-2022:8965?
Red Hat Single Sign-On 7.6 is the affected application in RHSA-2022:8965.
What are the key features of Red Hat Single Sign-On 7.6?
Red Hat Single Sign-On 7.6 provides authentication and standards-based single sign-on capabilities for web and mobile applications.
What should I do if I cannot update to Red Hat Single Sign-On 7.6.1 due to compatibility issues?
If compatibility issues prevent the update to Red Hat Single Sign-On 7.6.1, consider implementing security controls and monitoring as a temporary measure.