RHSA-2020:2813HighCVSS 8.1

Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update

Published
July 2, 2020
Last Modified
August 7, 2026

🔗 CVE IDs covered (11)

CVE-2020-8840 →CVE-2020-10719 →CVE-2020-10969 →CVE-2020-11023 →CVE-2020-1714 →CVE-2020-9546 →CVE-2020-9547 →CVE-2020-9548 →CVE-2020-10748 →CVE-2020-11022 →CVE-2020-1694 →

📋 Description

CVE-2020-1694 — keycloak: verify-token-audience support is missing in the NodeJS adapter CVE-2020-1714 — keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution CVE-2020-8840 — jackson-databind: Lacks certain xbean-reflect/JNDI blocking CVE-2020-9546 — jackson-databind: Serialization gadgets in shaded-hikari-config CVE-2020-9547 — jackson-databind: Serialization gadgets in ibatis-sqlmap CVE-2020-9548 — jackson-databind: Serialization gadgets in anteros-core CVE-2020-10719 — undertow: invalid HTTP request with large chunk size CVE-2020-10748 — keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) CVE-2020-10969 — jackson-databind: Serialization gadgets in javax.swing.JEditorPane CVE-2020-11022 — jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method CVE-2020-11023 — jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods

🎯 Affected products1

  • Red Hat Single Sign-On 7.4.1

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: There is currently no known mitigation for this issue. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (15)