Skip to content
OpenAdvisories
Critical RHSA-2022:6783 8 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 8

Published Sep 29, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.5::el8 rh-sso7-keycloak 0:15.0.8-1.redhat_00001.1.el8sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.5::el8 rh-sso7-keycloak-server 0:15.0.8-1.redhat_00001.1.el8sso

Vulnerabilities 8

  • Critical 9.8
    CVE-2021-42392 Public exploit Scanner template EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven
  • High 7.5
    CVE-2020-36518 Public exploit

    Deeply nested json in jackson-databind

    jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

    management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2022-0084

    XNIO `notifyReadClosed` method logging message to unexpected end

    A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related perf…

    jboss-xnio jboss-xnio org.jboss.xnio:xnio-all Debian Ubuntu Maven
  • High 7.2
    CVE-2022-2668

    Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

    An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

    org.keycloak:keycloak-parent Maven
  • Medium 6.5
    CVE-2021-43797

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.4
    CVE-2022-0225

    Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown

    A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.

    org.keycloak:keycloak-core Maven
  • Medium 5.4
    CVE-2022-2256

    Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

    A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.

    org.keycloak:keycloak-parent Maven
  • Unscored —
    CVE-2022-0866

    This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an…

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2031958
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2039403
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2040268
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2060929
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064698
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2101942
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2115392
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6783.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-36518
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-36518
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-36518
  • advisory
    https://github.com/advisories/GHSA-57j2-w4cx-62h2
  • report
    https://access.redhat.com/security/cve/CVE-2021-42392
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-42392
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-42392
  • article
    https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6
  • report
    https://access.redhat.com/security/cve/CVE-2021-43797
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-43797
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-43797
  • article
    https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
  • report
    https://access.redhat.com/security/cve/CVE-2022-0084
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-0084
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-0084
  • report
    https://access.redhat.com/security/cve/CVE-2022-0225
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-0225
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-0225
  • article
    https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m
  • report
    https://access.redhat.com/security/cve/CVE-2022-0866
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-0866
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-0866
  • report
    https://access.redhat.com/security/cve/CVE-2022-2256
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-2256
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-2256
  • article
    https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49
  • report
    https://access.redhat.com/security/cve/CVE-2022-2668
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-2668
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-2668