RHSA-2021:0327: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.5 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.4.5 serves as a replacement for Red Hat Single Sign-On 7.4.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es):

• undertow: special character in query results in server errors (CVE-2020-27782)
• keycloak: Default Client configuration is vulnerable to SSRF using “request_uri” parameter (CVE-2020-10770)
• apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)
• wildfly: resource adapter logs plaintext JMS password at warning level on connection error (CVE-2020-25640)
• wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller (CVE-2020-25689) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Related CVEs:
• CVE-2020-10770: keycloak: Default Client configuration is vulnerable to SSRF using “request_uri” parameter
• CVE-2020-13956: apache-httpclient: incorrect handling of malformed authority component in request URIs
• CVE-2020-25633: resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client’s WebApplicationException handling
• CVE-2020-25640: wildfly: resource adapter logs plaintext JMS password at warning level on connection error
• CVE-2020-25689: wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller
• CVE-2020-27782: undertow: special character in query results in server errors
• CVE-2020-27822: wildfly: Potential Memory leak in Wildfly when using OpenTracing