Skip to content
OpenAdvisories
High RHSA-2021:2065 2 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.4.7 security update on RHEL 8

Published Aug 4, 2025 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el8 rh-sso7-keycloak 0:9.0.13-1.redhat_00006.1.el8sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el8 rh-sso7-keycloak-server 0:9.0.13-1.redhat_00006.1.el8sso

Vulnerabilities 2

  • High 7.1
    CVE-2021-3461

    Keycloak insufficient session expiration

    A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

    org.keycloak:keycloak-parent Maven
  • Medium 5.3
    CVE-2021-3424

    Keycloak is vulnerable to IDN homograph attack

    A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.

    org.keycloak:keycloak-services Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/html/release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1933320
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1941565
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2065.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3424
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3424
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3424
  • article
    https://github.com/keycloak/keycloak/security/advisories/GHSA-mwm4-5qwr-g9pf
  • report
    https://access.redhat.com/security/cve/CVE-2021-3461
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3461
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3461