Skip to content
OpenAdvisories
Medium RHSA-2019:3049 1 CVE

Red Hat Security Advisory: RH-SSO 7.3.4 adapters for Enterprise Application Platform 7.2 security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-keycloak-adapter-sso7_3 0:4.8.13-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el6 eap7-keycloak-saml-adapter-sso7_3 0:4.8.13-1.Final_redhat_00001.1.el6eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el7 eap7-keycloak-adapter-sso7_3 0:4.8.13-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el7 eap7-keycloak-saml-adapter-sso7_3 0:4.8.13-1.Final_redhat_00001.1.el7eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el8 eap7-keycloak-adapter-sso7_3 0:4.8.13-1.Final_redhat_00001.1.el8eap
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.2::el8 eap7-keycloak-saml-adapter-sso7_3 0:4.8.13-1.Final_redhat_00001.1.el8eap

Vulnerabilities 1

  • Medium 4.3
    CVE-2019-14820

    Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

    It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

    Keycloak Keycloak org.keycloak:keycloak-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1649870
  • article
    https://issues.redhat.com/browse/JBEAP-17585
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3049.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-14820
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14820
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14820