RHSA-2022:7411MediumCVSS 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9

Published
November 3, 2022
Last Modified
August 7, 2026

🔗 CVE IDs covered (11)

CVE-2021-42575 →CVE-2022-0084 →CVE-2022-1319 →CVE-2022-2668 →CVE-2020-36518 →CVE-2021-42392 →CVE-2021-43797 →CVE-2022-0225 →CVE-2022-0853 →CVE-2022-0866 →CVE-2022-23913 →

📋 Description

CVE-2020-36518 — jackson-databind: denial of service via a large depth of nested objects CVE-2021-42392 — h2: Remote Code Execution in Console CVE-2021-42575 — owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution CVE-2021-43797 — netty: control chars in header names may lead to HTTP request smuggling CVE-2022-0084 — xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr CVE-2022-0225 — keycloak: Stored XSS in groups dropdown CVE-2022-0853 — jboss-client: memory leakage in remote client transaction CVE-2022-0866 — wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled CVE-2022-1319 — undertow: Double AJP response for 400 from EAP 7 results in CPING failures CVE-2022-2668 — keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console CVE-2022-23913 — artemis-commons: Apache ActiveMQ Artemis DoS

🎯 Affected products11

  • Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-0:1-5.el9sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-0:1-5.el9sso.x86_64 as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-javapackages-filesystem-0:6.0.0-7.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-javapackages-tools-0:6.0.0-7.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-javapackages-tools-0:6.0.0-7.el9sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-keycloak-0:18.0.3-1.redhat_00001.1.el9sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-keycloak-server-0:18.0.3-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-python3-javapackages-0:6.0.0-7.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9
  • rh-sso7-runtime-0:1-5.el9sso.x86_64 as a component of Red Hat Single Sign-On 7.6 for RHEL 9

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: In order to avoid the possibility of information access, review application source code for '@RunAs' and 'run-as-principal' usage. Also, make sure the application is using or not Elytron Security. It's possible to investigate by checking if the commands from '$JBOSS_HOME/docs/examples/enable-elytron.cli' or similar were executed.

🔗 References (11)