Skip to content
OpenAdvisories
High 1 exploited CVE RHSA-2023:7484 3 CVEs

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9

Published Sep 30, 2024 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el9 rh-sso7-keycloak 0:18.0.11-2.redhat_00001.1.el9sso
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el9 rh-sso7-keycloak-server 0:18.0.11-2.redhat_00001.1.el9sso

Vulnerabilities 3

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • Medium 6.5
    CVE-2023-0105

    Keycloak: Impersonation and lockout possible through incorrect handling of email trust

    A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.

    redhat.com Keycloak org.keycloak:keycloak-core Maven
  • Medium 5.3
    CVE-2023-33201

    Bouncy Castle For Java LDAP injection vulnerability

    Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

    druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2158910
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2215465
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2242803
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7484.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-0105
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-0105
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-0105
  • advisory
    https://github.com/advisories/GHSA-c7xw-p58w-h6fj
  • report
    https://access.redhat.com/security/cve/CVE-2023-33201
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-33201
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-33201
  • article
    https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
  • report
    https://access.redhat.com/security/cve/CVE-2023-44487
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-44487
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-44487
  • article
    https://github.com/dotnet/announcements/issues/277
  • advisory
    https://pkg.go.dev/vuln/GO-2023-2102
  • article
    https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
  • article
    https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog