Skip to content
OpenAdvisories
Medium RHSA-2021:0318 1 CVE

Red Hat Security Advisory: Red Hat Single Sign-On 7.4.5 security update on RHEL 6

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak 0:9.0.11-1.redhat_00001.1.el6sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el6 rh-sso7-keycloak-server 0:9.0.11-1.redhat_00001.1.el6sso

Vulnerabilities 1

  • Medium 5.3
    CVE-2020-10770 Public exploit Scanner template EPSS 70%

    Keycloak vulnerable to Server-Side Request Forgery

    A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

    org.keycloak:keycloak-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/html/release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1846270
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0318.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-10770
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-10770
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-10770