Red Hat Security Advisory: Red Hat Single Sign-On 7.4.9 security update

CVE-2020-28491 — jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception CVE-2020-35509 — keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity CVE-2021-3513 — keycloak: Brute force attack is possible even after the account lockout CVE-2021-3597 — undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS CVE-2021-3632 — keycloak: Anyone can register a new device when there is no device registered for passwordless login CVE-2021-3637 — keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly could lead to a DoS attack CVE-2021-3644 — wildfly-core: Invalid Sensitivity Classification of Vault Expression CVE-2021-3690 — undertow: buffer leak on incoming websocket PONG message may lead to DoS CVE-2021-28170 — jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate CVE-2021-29425 — apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6