Skip to content
OpenAdvisories
High RHSA-2020:4929 2 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update on RHEL 6

Published Sep 22, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak 0:9.0.9-1.redhat_00001.1.el6sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak-server 0:9.0.9-1.redhat_00001.1.el6sso

Vulnerabilities 2

  • High 8.1
    CVE-2020-14389

    Improper privilege management in Keycloak

    It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.

    org.keycloak:keycloak-core Maven
  • Medium 4.8
    CVE-2020-10776

    Cross-site Scripting in keycloak

    A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.

    org.keycloak:keycloak-services org.keycloak:keycloak-server-spi-private Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1847428
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1875843
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4929.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-10776
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-10776
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-10776
  • report
    https://access.redhat.com/security/cve/CVE-2020-14389
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-14389
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-14389