RHSA-2022:1463LowCVSS 5.9

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 8

Published
April 20, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2021-45105 →

📋 Description

CVE-2021-45105 — log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

🎯 Affected products4

  • Red Hat Single Sign-On 7.5 for RHEL 8
  • rh-sso7-keycloak-0:15.0.6-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8
  • rh-sso7-keycloak-0:15.0.6-1.redhat_00001.1.el8sso.src as a component of Red Hat Single Sign-On 7.5 for RHEL 8
  • rh-sso7-keycloak-server-0:15.0.6-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: For Log4j 2 versions up to and including 2.16.0, this flaw can be mitigated by: - In PatternLayout in the Log4j logging configuration, replace Context Lookups like ${ctx:loginId} or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) like %X{loginId}. - Otherwise, in the Log4j logging configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.

🔗 References (5)