Skip to content
OpenAdvisories
High RHSA-2020:2108 3 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.3.8 security update on RHEL 8

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el8 rh-sso7-keycloak 0:4.8.20-1.Final_redhat_00001.1.el8sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el8 rh-sso7-keycloak-server 0:4.8.20-1.Final_redhat_00001.1.el8sso

Vulnerabilities 3

  • High 7.1
    CVE-2020-1718

    Improper Authentication for Keycloak

    A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 5.3
    CVE-2020-1758

    Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak

    A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 4.3
    CVE-2020-1724

    Keycloak Insufficient Session Expiry

    A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.

    Red Hat keycloak org.keycloak:keycloak-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1796756
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1800527
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1812514
  • article
    https://issues.redhat.com/browse/KEYCLOAK-13799
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2108.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-1718
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1718
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1718
  • report
    https://access.redhat.com/security/cve/CVE-2020-1724
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1724
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1724
  • report
    https://access.redhat.com/security/cve/CVE-2020-1758
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1758
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1758
  • article
    https://issues.redhat.com/browse/KEYCLOAK-13285