RHSA-2022:0152HighCVSS 8.3

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8

Published
January 17, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2021-40690 →CVE-2021-3827 →CVE-2021-4133 →CVE-2021-20289 →

📋 Description

CVE-2021-3827 — keycloak-server-spi-private: ECP SAML binding bypasses authentication flows CVE-2021-4133 — Keycloak: Incorrect authorization allows unpriviledged users to create other users CVE-2021-20289 — resteasy: Error message exposes endpoint class information CVE-2021-40690 — xml-security: XPath Transform abuse allows for information disclosure

🎯 Affected products4

  • Red Hat Single Sign-On 7.5 for RHEL 8
  • rh-sso7-keycloak-0:15.0.4-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8
  • rh-sso7-keycloak-0:15.0.4-1.redhat_00001.1.el8sso.src as a component of Red Hat Single Sign-On 7.5 for RHEL 8
  • rh-sso7-keycloak-server-0:15.0.4-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Access to the user-creation functionality in the REST endpoint can be deactivated using CLI commands in undertow. run: bin/jboss-cli.sh --connect /subsystem=undertow/configuration=filter/expression-filter=keycloakPathOverrideUsersCreateEndpoint:add( \ expression="(regex('^/auth/admin/realms/(.*)/users$') and method(POST))-> response-code(400)" \ ) /subsystem=undertow/server=default-server/host=default-host/filter-ref=keycloakPathOverrideUsersCreateEndpoint:add()

🔗 References (9)