Skip to content
OpenAdvisories
Critical RHSA-2022:7410 11 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8

Published Sep 29, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el8 rh-sso7-keycloak 0:18.0.3-1.redhat_00001.1.el8sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el8 rh-sso7-keycloak-server 0:18.0.3-1.redhat_00001.1.el8sso

Vulnerabilities 11

  • Critical 9.8
    CVE-2021-42392 Public exploit Scanner template EPSS 83%

    RCE in H2 Console

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This…

    h2database h2 com.h2database:h2 h2database Debian Ubuntu Maven
  • Critical 9.8
    CVE-2021-42575

    Policies not properly enforced in OWASP Java HTML Sanitizer

    The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

    com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Maven
  • High 7.5
    CVE-2020-36518 Public exploit

    Deeply nested json in jackson-databind

    jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

    management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2022-0084

    XNIO `notifyReadClosed` method logging message to unexpected end

    A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related perf…

    jboss-xnio jboss-xnio org.jboss.xnio:xnio-all Debian Ubuntu Maven
  • High 7.5
    CVE-2022-23913

    Apache ActiveMQ Artemis DoS

    In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

    Apache Software Foundation Apache ActiveMQ Artemis org.apache.activemq:artemis-core-client Maven
  • High 7.2
    CVE-2022-2668

    Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

    An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

    org.keycloak:keycloak-parent Maven
  • Medium 6.5
    CVE-2021-43797

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.4
    CVE-2022-0225

    Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown

    A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.

    org.keycloak:keycloak-core Maven
  • Unscored —
    CVE-2022-0853 Public exploit

    A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using Us…

  • Unscored —
    CVE-2022-0866

    This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an…

  • Unscored —
    CVE-2022-1319

    A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those pack…

    undertow undertow Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2031958
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2039403
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2040268
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2060929
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064226
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064698
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2115392
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7410.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-36518
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-36518
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-36518
  • advisory
    https://github.com/advisories/GHSA-57j2-w4cx-62h2
  • report
    https://access.redhat.com/security/cve/CVE-2021-42392
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-42392
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-42392
  • article
    https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6
  • report
    https://access.redhat.com/security/cve/CVE-2021-42575
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2027195
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-42575
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-42575
  • report
    https://access.redhat.com/security/cve/CVE-2021-43797
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-43797
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-43797
  • article
    https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
  • report
    https://access.redhat.com/security/cve/CVE-2022-0084
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-0084
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-0084
  • report
    https://access.redhat.com/security/cve/CVE-2022-0225
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-0225
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-0225
  • article
    https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m
  • report
    https://access.redhat.com/security/cve/CVE-2022-0853
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2060725
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-0853
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-0853
  • report
    https://access.redhat.com/security/cve/CVE-2022-0866
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-0866
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-0866