Skip to content
OpenAdvisories
Low RHSA-2019:0857 1 CVE

Red Hat Security Advisory: Red Hat Single Sign-On 7.2.7 security update on RHEL 6

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak-server 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6

Vulnerabilities 1

  • Low 3.8
    CVE-2019-3868

    Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

    Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

    Red Hat keycloak org.keycloak:keycloak-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1679144
  • article
    https://issues.redhat.com/browse/JBEAP-16661
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0857.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-3868
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-3868
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-3868