RHSA-2020:3501HighCVSS 8.1

Red Hat Security Advisory: Red Hat Single Sign-On 7.4.2 security update

Published
August 18, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (15)

CVE-2020-10673 →CVE-2020-10740 →CVE-2020-1710 →CVE-2020-1748 →CVE-2020-10683 →CVE-2020-10687 →CVE-2020-10718 →CVE-2020-10672 →CVE-2020-10693 →CVE-2020-10758 →CVE-2020-10714 →CVE-2020-11612 →CVE-2020-14297 →CVE-2020-14307 →CVE-2020-1728 →

📋 Description

CVE-2020-1710 — EAP: field-name is not parsed in accordance to RFC7230 CVE-2020-1728 — keycloak: security headers missing on REST endpoints CVE-2020-1748 — Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain CVE-2020-10672 — jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution CVE-2020-10673 — jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution CVE-2020-10683 — dom4j: XML External Entity vulnerability in default SAX parser CVE-2020-10687 — Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests CVE-2020-10693 — hibernate-validator: Improper input validation in the interpolation of constraint error messages CVE-2020-10714 — wildfly-elytron: session fixation when using FORM authentication CVE-2020-10718 — wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API CVE-2020-10740 — wildfly: unsafe deserialization in Wildfly Enterprise Java Beans CVE-2020-10758 — keycloak: DoS by sending multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body CVE-2020-11612 — netty: compression/decompression codecs don't enforce limits on buffer allocation sizes CVE-2020-14297 — wildfly: Some EJB transaction objects may get accumulated causing Denial of Service CVE-2020-14307 — wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service

🎯 Affected products1

  • Red Hat Single Sign-On 7.4.2

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: There is currently no known mitigation for this issue. Workaround: You can pass user input as an expression variable by unwrapping the context to HibernateConstraintValidatorContext. Please refer to the https://in.relation.to/2020/05/07/hibernate-validator-615-6020-released/ and https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#_the_code_constraintvalidatorcontext_code. Workaround: This attack is dependent on the attacker being able to create a session and the victim accessing the session before the session expires, we do have a 15 minute session timeout by default but the attacker could also keep this alive by say sending in a request every five minutes. The server by default supports session tracking by URL and Cookie, if the web.xml is updated to support COOKIE only the exploit is not possible by sharing the link. ~~~ <session-config> <tracking-mode>URL</tracking-mode> </session-config> ~~~ TO ~~~ <session-config> <tracking-mode>COOKIE</tracking-mode> </session-config> ~~~ Workaround: - The possibility of this issue largely depends on the environment, specifically the load balancer or reverse proxies between the client and the server. The issue occurs when there is no load balancer in place. - Proper tuning of HTTP request timeout and keycloak database max pool size can mitigate this issue : bin/jboss-cli.sh --connect --commands='/subsystem=transactions:write-attribute(name=default-timeout,value=30),/subsystem=undertow/server=default-server/http-listener=default/:write-attribute(name=read-timeout,value=30000),/subsystem=undertow/server=default-server/https-listener=https/:write-attribute(name=read-timeout,value=30000),/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=max-pool-size,value=100),reload'

🔗 References (19)