Skip to content
OpenAdvisories
High RHSA-2022:0152 4 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8

Published Sep 16, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.5::el8 rh-sso7-keycloak 0:15.0.4-1.redhat_00001.1.el8sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.5::el8 rh-sso7-keycloak-server 0:15.0.4-1.redhat_00001.1.el8sso

Vulnerabilities 4

  • High 8.8
    CVE-2021-4133

    Improper Authorization in Keycloak

    A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

    org.keycloak:keycloak-services Maven
  • High 8.1
    CVE-2021-3827

    ECP SAML binding bypasses authentication flows

    A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization head…

    org.keycloak:keycloak-saml-core Maven
  • High 7.5
    CVE-2021-40690

    Bypass of the secureValidation property

    All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abus…

    Apache Software Foundation Apache Santuario org.apache.santuario:xmlsec libxml-security-java Debian Ubuntu Maven
  • Medium 5.3
    CVE-2021-20289

    Exposure of class information in RESTEasy

    A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS reso…

    resteasy resteasy3.0 org.jboss.resteasy:resteasy-core Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1935927
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2007512
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2011190
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2033602
  • article
    https://issues.redhat.com/browse/CIAM-1615
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0152.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3827
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3827
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3827
  • article
    https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v
  • report
    https://access.redhat.com/security/cve/CVE-2021-4133
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-4133
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-4133
  • article
    https://github.com/keycloak/keycloak/issues/9247
  • article
    https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
  • report
    https://access.redhat.com/security/cve/CVE-2021-20289
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-20289
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-20289
  • report
    https://access.redhat.com/security/cve/CVE-2021-40690
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-40690
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-40690
  • article
    https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E