RHSA-2022:0164HighCVSS 8.3

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update

Published
January 18, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2021-3827 →CVE-2021-4133 →CVE-2021-20289 →CVE-2021-40690 →

📋 Description

CVE-2021-3827 — keycloak-server-spi-private: ECP SAML binding bypasses authentication flows CVE-2021-4133 — Keycloak: Incorrect authorization allows unpriviledged users to create other users CVE-2021-20289 — resteasy: Error message exposes endpoint class information CVE-2021-40690 — xml-security: XPath Transform abuse allows for information disclosure

🎯 Affected products2

  • Middleware Containers for OpenShift
  • rh-sso-7/sso75-openshift-rhel8@sha256:720a7e4c4926c41c1219a90daaea3b971a3d0da5a152a96fed4fb544d80f52e3_amd64 as a component of Middleware Containers for OpenShift

✅ Remediation

To update to the latest Red Hat Single Sign-On 7.5.1 for OpenShift image, Follow these steps to pull in the content: 1. On your master hosts, ensure you are logged into the CLI as a cluster administrator or user with project administrator access to the global "openshift" project. For example: $ oc login -u system:admin 2. Update the core set of Red Hat Single Sign-On resources for OpenShift in the "openshift" project by running the following commands: $ for resource in sso75-image-stream.json \ sso75-https.json \ sso75-mysql.json \ sso75-mysql-persistent.json \ sso75-postgresql.json \ sso75-postgresql-persistent.json \ sso75-x509-https.json \ sso75-x509-mysql-persistent.json \ sso75-x509-postgresql-persistent.json do oc replace -n openshift --force -f \ https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/v7.5.1.GA/templates/${resource} done 3. Install the Red Hat Single Sign-On 7.5.1 for OpenShift streams in the "openshift" project by running the following commands: $ oc -n openshift import-image redhat-sso75-openshift:1.0 Workaround: Access to the user-creation functionality in the REST endpoint can be deactivated using CLI commands in undertow. run: bin/jboss-cli.sh --connect /subsystem=undertow/configuration=filter/expression-filter=keycloakPathOverrideUsersCreateEndpoint:add( \ expression="(regex('^/auth/admin/realms/(.*)/users$') and method(POST))-> response-code(400)" \ ) /subsystem=undertow/server=default-server/host=default-host/filter-ref=keycloakPathOverrideUsersCreateEndpoint:add()

🔗 References (7)