RHSA-2022:0155HighCVSS 8.3

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update

Published
January 17, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2021-20289 →CVE-2021-40690 →CVE-2021-3827 →CVE-2021-4133 →

📋 Description

CVE-2021-3827 — keycloak-server-spi-private: ECP SAML binding bypasses authentication flows CVE-2021-4133 — Keycloak: Incorrect authorization allows unpriviledged users to create other users CVE-2021-20289 — resteasy: Error message exposes endpoint class information CVE-2021-40690 — xml-security: XPath Transform abuse allows for information disclosure

🎯 Affected products1

  • RHSSO 7.5.1

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Access to the user-creation functionality in the REST endpoint can be deactivated using CLI commands in undertow. run: bin/jboss-cli.sh --connect /subsystem=undertow/configuration=filter/expression-filter=keycloakPathOverrideUsersCreateEndpoint:add( \ expression="(regex('^/auth/admin/realms/(.*)/users$') and method(POST))-> response-code(400)" \ ) /subsystem=undertow/server=default-server/host=default-host/filter-ref=keycloakPathOverrideUsersCreateEndpoint:add()

🔗 References (9)