RHSA-2021:0327HighCVSS 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.4.5 security update

Published
February 1, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2020-10770 →CVE-2020-13956 →CVE-2020-25633 →CVE-2020-25640 →CVE-2020-25689 →CVE-2020-27782 →CVE-2020-27822 →

📋 Description

CVE-2020-10770 — keycloak: Default Client configuration is vulnerable to SSRF using "request_uri" parameter CVE-2020-13956 — apache-httpclient: incorrect handling of malformed authority component in request URIs CVE-2020-25633 — resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling CVE-2020-25640 — wildfly: resource adapter logs plaintext JMS password at warning level on connection error CVE-2020-25689 — wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller CVE-2020-27782 — undertow: special character in query results in server errors CVE-2020-27822 — wildfly: Potential Memory leak in Wildfly when using OpenTracing

🎯 Affected products1

  • Red Hat Single Sign-On 7.4.5

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: The issue can be mitigated by using HTTP/1.1 instead of AJP to proxy to the back-end.

🔗 References (10)