Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 7

Fixed packages 5

Vulnerabilities 6

• Critical 9.8
  CVE-2019-14379

  Deserialization of untrusted data in FasterXML jackson-databind

  SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Jul 29, 2019
• High 7.5
  CVE-2019-12086 Public exploit EPSS 22%

  Information exposure in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  May 17, 2019
• Medium 5.9
  CVE-2019-12814 Public exploit EPSS 11%

  Deserialization of untrusted data in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the class…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jun 19, 2019
• Medium 5.3
  CVE-2019-10184

  Undertow Missing Authorization when requesting a protected directory without trailing slash

  undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

  undertow-io undertow undertow undertow Debian Ubuntu Maven
  Jul 25, 2019
• Medium 5.0
  CVE-2019-14832

  Keycloak Unauthenticated Access

  A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry…

  Keycloak keycloak REST API org.keycloak:keycloak-model-jpa org.keycloak:keycloak-model-infinispan Maven
  Oct 15, 2019
• Medium 4.3
  CVE-2019-14820

  Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

  It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

  Keycloak Keycloak org.keycloak:keycloak-core Maven
  Jan 8, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649870
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1713068
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1713468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1725795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1737517
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1749487
• article
  https://issues.redhat.com/browse/KEYCLOAK-11455
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3045.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10184
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10184
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10184
• report
  https://access.redhat.com/security/cve/CVE-2019-12086
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-12086
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-12086
• report
  https://access.redhat.com/security/cve/CVE-2019-12814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-12814
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-12814
• report
  https://access.redhat.com/security/cve/CVE-2019-14379
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14379
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14379
• report
  https://access.redhat.com/security/cve/CVE-2019-14820
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14820
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14820
• report
  https://access.redhat.com/security/cve/CVE-2019-14832
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14832
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14832