Skip to content
OpenAdvisories
High RHSA-2017:0872 3 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.1 update on RHEL 6

Published Sep 13, 2024 · Updated Mar 18, 2026

Ecosystem: Red Hat

Fixed packages 17

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7 0:1-2.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-freemarker 0:2.3.23-1.redhat_2.2.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-javapackages-tools 0:3.4.1-5.15.3.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak 0:2.5.5-2.Final_redhat_1.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak-server 0:2.5.5-2.Final_redhat_1.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-libunix-dbus-java 0:0.8.0-2.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-libunix-dbus-java-debuginfo 0:0.8.0-2.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-libunix-dbus-java-devel 0:0.8.0-2.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-liquibase 0:3.4.1-2.redhat_2.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-liquibase-core 0:3.4.1-2.redhat_2.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-python-javapackages 0:3.4.1-5.15.3.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-runtime 0:1-2.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-twitter4j 0:4.0.4-1.redhat_3.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-twitter4j-core 0:4.0.4-1.redhat_3.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-zxing 0:3.2.1-1.redhat_4.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-zxing-core 0:3.2.1-1.redhat_4.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-zxing-javase 0:3.2.1-1.redhat_4.1.jbcs.el6

Vulnerabilities 3

  • High 7.5
    CVE-2016-9589

    Red Hat Wildfly DoS

    Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill m…

    Red Hat wildfly org.wildfly:wildfly-undertow Maven
  • Medium 5.9
    CVE-2017-2585

    keycloak-core vulnerable to timing attacks against JWS token verification

    Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

    Red Hat keycloak org.keycloak:keycloak-core Maven
  • Medium —
    CVE-2016-8629

    Moderate severity vulnerability that affects org.keycloak:keycloak-core

    Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete…

    Red Hat keycloak org.keycloak:keycloak-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.1/html/release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1388988
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1404782
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1412376
  • article
    https://issues.redhat.com/browse/RHSSO-427
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0872.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-8629
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-8629
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-8629
  • report
    https://access.redhat.com/security/cve/CVE-2016-9589
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-9589
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-9589
  • report
    https://access.redhat.com/security/cve/CVE-2017-2585
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2585
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2585