RHSA-2020:4931MediumCVSS 8.1

Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update

Published
November 4, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2020-1954 →CVE-2020-10776 →CVE-2020-14299 →CVE-2020-14338 →CVE-2020-14340 →CVE-2020-14366 →CVE-2020-14389 →

📋 Description

CVE-2020-1954 — cxf: JMX integration is vulnerable to a MITM attack CVE-2020-10776 — keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS CVE-2020-14299 — picketbox: JBoss EAP reload to admin-only mode allows authentication bypass CVE-2020-14338 — wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl CVE-2020-14340 — xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS CVE-2020-14366 — keycloak: path traversal in resources CVE-2020-14389 — keycloak: user can manage resources with just "view-profile" role using new Account Console

🎯 Affected products1

  • Red Hat Single Sign-On 7.4.3

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Trusted Hosts Policy could be used to mitigate this attack : https://www.keycloak.org/docs/latest/securing_apps/index.html#client-registration-policies

🔗 References (11)