Skip to content
OpenAdvisories
Medium RHSA-2019:3048 1 CVE

Red Hat Security Advisory: RH-SSO 7.3.4 adapters for Enterprise Application Platform 6 security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 keycloak-adapter-sso7_3-eap6 0:4.8.13-1.Final_redhat_00001.1.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 keycloak-saml-adapter-sso7_3-eap6 0:4.8.13-1.Final_redhat_00001.1.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 keycloak-adapter-sso7_3-eap6 0:4.8.13-1.Final_redhat_00001.1.ep6.el7
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 keycloak-saml-adapter-sso7_3-eap6 0:4.8.13-1.Final_redhat_00001.1.ep6.el7

Vulnerabilities 1

  • Medium 4.3
    CVE-2019-14820

    Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

    It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

    Keycloak Keycloak org.keycloak:keycloak-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1649870
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3048.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-14820
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14820
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14820