High RHSA-2023:4920 3 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.5 security update on RHEL 9

Published Sep 30, 2024 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 2

Release	Package	Fixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el9	rh-sso7-keycloak	0:18.0.9-1.redhat_00001.1.el9sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el9	rh-sso7-keycloak-server	0:18.0.9-1.redhat_00001.1.el9sso

Vulnerabilities 3

High 7.5

CVE-2021-46877

jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven

Mar 18, 2023
High 7.5

CVE-2023-3223

Undertow: outofmemoryerror due to @multipartconfig handling

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limi…

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 RHEL-8 based Middleware Containers Debian Ubuntu Maven

Sep 27, 2023
Medium 5.9

CVE-2023-1436

Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

Jettison Jettison druid libjettison-java Debian Ubuntu Wolfi Maven

Mar 16, 2023

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182788
report
https://bugzilla.redhat.com/show_bug.cgi?id=2185707
report
https://bugzilla.redhat.com/show_bug.cgi?id=2209689
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4920.json
report
https://access.redhat.com/security/cve/CVE-2021-46877
advisory
https://www.cve.org/CVERecord?id=CVE-2021-46877
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-46877
report
https://access.redhat.com/security/cve/CVE-2023-1436
advisory
https://www.cve.org/CVERecord?id=CVE-2023-1436
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-1436
article
https://research.jfrog.com/vulnerabilities/jettison-json-array-dos-xray-427911/
report
https://access.redhat.com/security/cve/CVE-2023-3223
advisory
https://www.cve.org/CVERecord?id=CVE-2023-3223
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-3223