Synopsis

Moderate: Red Hat Single Sign-On 7.1 update on RHEL 6

Type/Severity

Security Advisory: Moderate

Topic

Red Hat Single Sign-On 7.1 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.1 serves as a replacement for Red Hat Single Sign-On 7.0, and includes several bug fixes and enhancements. For further information regarding those, refer to the Release Notes linked to in the References section.

Security Fix(es):

• It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the REST server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm. (CVE-2016-8629)
  
• It was found that JBoss EAP 7 Header Cache was inefficient. An attacker could use this flaw to cause a denial of service attack. (CVE-2016-9589)
  
• It was found that keycloak's implementation of HMAC verification for JWS tokens uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. (CVE-2017-2585)
  

Red Hat would like to thank Gabriel Lavoie (Halogen Software) for reporting CVE-2016-9589 and Richard Kettelerij (Mindloops) for reporting CVE-2017-2585.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Single Sign-On 7.2 for RHEL 6 x86_64
• Red Hat Single Sign-On 7.1 for RHEL 6 x86_64

Fixes

• BZ - 1388988 - CVE-2016-8629 keycloak: user deletion via incorrect permissions check
• BZ - 1404782 - CVE-2016-9589 wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage
• BZ - 1412376 - CVE-2017-2585 keycloak: timing attack in JWS signature verification

CVEs

• CVE-2016-8629
• CVE-2016-9589
• CVE-2017-2585

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.1/html/release_notes/

Red Hat Single Sign-On 7.2 for RHEL 6

SRPM
rh-sso7-1-2.jbcs.el6.src.rpm	SHA-256: 3b69be7a6609a44cdb4db23b7369aa79db996cb71a14a27dca87896deb5d7e95
rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el6.src.rpm	SHA-256: 0ad763f35755fbd1b660762b660dfcd2c178077766cca8c23975356905936941
rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el6.src.rpm	SHA-256: c5bb3855cc01d1ed11704def0ed510863b1a1ec6a49fcb84180c0bc7d0a90794
rh-sso7-keycloak-2.5.5-2.Final_redhat_1.1.jbcs.el6.src.rpm	SHA-256: cc292d4330eb89f5b0e12d18b79c95554acec395f449f43e96390f12fefede44
rh-sso7-libunix-dbus-java-0.8.0-2.jbcs.el6.src.rpm	SHA-256: 607f3d0c4a49278f4f61ba05b23c3f709c6c1cdeace674c5b1f8f90df8d32cc3
rh-sso7-liquibase-3.4.1-2.redhat_2.1.jbcs.el6.src.rpm	SHA-256: f3701754fecac753e85f741ea98426cc5f6fe3e0898eab8a20be6f83b27c34da
rh-sso7-twitter4j-4.0.4-1.redhat_3.1.jbcs.el6.src.rpm	SHA-256: 361ce470fc4ac29148e9307d978c665292c7cf90cb918b039405614317015c4f
rh-sso7-zxing-3.2.1-1.redhat_4.1.jbcs.el6.src.rpm	SHA-256: 7355de21a43a0037d07a6c3bcfd82e1b433e2e88e795095f879fffcad34ec216
x86_64
rh-sso7-1-2.jbcs.el6.x86_64.rpm	SHA-256: 36f0858d4e56fe5cdc71cd7ff94d711c331822b0694ab624a377c32b27e3214f
rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el6.noarch.rpm	SHA-256: 158c5b4b31041ffc204c500d0d95288c66d0663ac6518698a927fd666685fff4
rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el6.noarch.rpm	SHA-256: 845a270c845cb8c2b1880a557328209db0b1aff8b2c173e1f83952c7a21ee446
rh-sso7-keycloak-2.5.5-2.Final_redhat_1.1.jbcs.el6.noarch.rpm	SHA-256: 16a2867aa76632062dcfe7e6934aa470cbae8dce354ed291cf12d7067fc8e01e
rh-sso7-keycloak-server-2.5.5-2.Final_redhat_1.1.jbcs.el6.noarch.rpm	SHA-256: f331b69dbd7a35e3b02c77c4d18061d31ddecb65e67beaffc9ddc4be2116039f
rh-sso7-libunix-dbus-java-0.8.0-2.jbcs.el6.x86_64.rpm	SHA-256: a00da74986994c98bb965344675c5c8c065ef3e7330c3f3e5985ba23a55e94b2
rh-sso7-libunix-dbus-java-debuginfo-0.8.0-2.jbcs.el6.x86_64.rpm	SHA-256: 9fa7c8b38570136d7aaca921efbc8949b06e2761ec1cfd92ff98a0fa231091b9
rh-sso7-libunix-dbus-java-devel-0.8.0-2.jbcs.el6.x86_64.rpm	SHA-256: 53eeb30c47e2bc3f4e84610e8f4be5cb36aea8fb6300b0f081c9302e0619fc9a
rh-sso7-liquibase-3.4.1-2.redhat_2.1.jbcs.el6.noarch.rpm	SHA-256: d6eb65a627580e5f96a241e950787b35c70bfde7ef107acfea467abb214e143b
rh-sso7-liquibase-core-3.4.1-2.redhat_2.1.jbcs.el6.noarch.rpm	SHA-256: 5ab18bd5c170619ad632e7981b5bbc7c7f72e975af180dbb82e91597c66e3788
rh-sso7-python-javapackages-3.4.1-5.15.3.jbcs.el6.noarch.rpm	SHA-256: ed2f2821fcf2ab52dea84e9d557d63cb2c55eb1c99043e7c4d9a91ea185bb69e
rh-sso7-runtime-1-2.jbcs.el6.x86_64.rpm	SHA-256: 0a5f499e901f2c3e21639404c51bd46db46053a6676d9f51b1d862736dd375c7
rh-sso7-twitter4j-4.0.4-1.redhat_3.1.jbcs.el6.noarch.rpm	SHA-256: 0762d99e2150dc0b1b12926edcaaeeffc94c90d4429d07e4d56f9dd224eaf7d7
rh-sso7-twitter4j-core-4.0.4-1.redhat_3.1.jbcs.el6.noarch.rpm	SHA-256: 1b3d56f62fae674a3b6ba8a4f3eefc1330f52755e7f6dd20ac135f26ee5a6439
rh-sso7-zxing-3.2.1-1.redhat_4.1.jbcs.el6.noarch.rpm	SHA-256: 2e25f2cfbb56f70ef12ad514fd838cd39407fbfc176b53a045158686cf6673a9
rh-sso7-zxing-core-3.2.1-1.redhat_4.1.jbcs.el6.noarch.rpm	SHA-256: d88e5c674ea00f4c8aca6fccd35a7373bb53a377c1e880dc566ea8ab1087662b
rh-sso7-zxing-javase-3.2.1-1.redhat_4.1.jbcs.el6.noarch.rpm	SHA-256: 67ff6c15f929839282ba1fd2a56d2666f1bc55a3427298905e8b5c4d0da4081c

Red Hat Single Sign-On 7.1 for RHEL 6

SRPM
rh-sso7-1-2.jbcs.el6.src.rpm	SHA-256: 3b69be7a6609a44cdb4db23b7369aa79db996cb71a14a27dca87896deb5d7e95
rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el6.src.rpm	SHA-256: 0ad763f35755fbd1b660762b660dfcd2c178077766cca8c23975356905936941
rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el6.src.rpm	SHA-256: c5bb3855cc01d1ed11704def0ed510863b1a1ec6a49fcb84180c0bc7d0a90794
rh-sso7-keycloak-2.5.5-2.Final_redhat_1.1.jbcs.el6.src.rpm	SHA-256: cc292d4330eb89f5b0e12d18b79c95554acec395f449f43e96390f12fefede44
rh-sso7-libunix-dbus-java-0.8.0-2.jbcs.el6.src.rpm	SHA-256: 607f3d0c4a49278f4f61ba05b23c3f709c6c1cdeace674c5b1f8f90df8d32cc3
rh-sso7-liquibase-3.4.1-2.redhat_2.1.jbcs.el6.src.rpm	SHA-256: f3701754fecac753e85f741ea98426cc5f6fe3e0898eab8a20be6f83b27c34da
rh-sso7-twitter4j-4.0.4-1.redhat_3.1.jbcs.el6.src.rpm	SHA-256: 361ce470fc4ac29148e9307d978c665292c7cf90cb918b039405614317015c4f
rh-sso7-zxing-3.2.1-1.redhat_4.1.jbcs.el6.src.rpm	SHA-256: 7355de21a43a0037d07a6c3bcfd82e1b433e2e88e795095f879fffcad34ec216
x86_64
rh-sso7-1-2.jbcs.el6.x86_64.rpm	SHA-256: 36f0858d4e56fe5cdc71cd7ff94d711c331822b0694ab624a377c32b27e3214f
rh-sso7-freemarker-2.3.23-1.redhat_2.2.jbcs.el6.noarch.rpm	SHA-256: 158c5b4b31041ffc204c500d0d95288c66d0663ac6518698a927fd666685fff4
rh-sso7-javapackages-tools-3.4.1-5.15.3.jbcs.el6.noarch.rpm	SHA-256: 845a270c845cb8c2b1880a557328209db0b1aff8b2c173e1f83952c7a21ee446
rh-sso7-keycloak-2.5.5-2.Final_redhat_1.1.jbcs.el6.noarch.rpm	SHA-256: 16a2867aa76632062dcfe7e6934aa470cbae8dce354ed291cf12d7067fc8e01e
rh-sso7-keycloak-server-2.5.5-2.Final_redhat_1.1.jbcs.el6.noarch.rpm	SHA-256: f331b69dbd7a35e3b02c77c4d18061d31ddecb65e67beaffc9ddc4be2116039f
rh-sso7-libunix-dbus-java-0.8.0-2.jbcs.el6.x86_64.rpm	SHA-256: a00da74986994c98bb965344675c5c8c065ef3e7330c3f3e5985ba23a55e94b2
rh-sso7-libunix-dbus-java-debuginfo-0.8.0-2.jbcs.el6.x86_64.rpm	SHA-256: 9fa7c8b38570136d7aaca921efbc8949b06e2761ec1cfd92ff98a0fa231091b9
rh-sso7-libunix-dbus-java-devel-0.8.0-2.jbcs.el6.x86_64.rpm	SHA-256: 53eeb30c47e2bc3f4e84610e8f4be5cb36aea8fb6300b0f081c9302e0619fc9a
rh-sso7-liquibase-3.4.1-2.redhat_2.1.jbcs.el6.noarch.rpm	SHA-256: d6eb65a627580e5f96a241e950787b35c70bfde7ef107acfea467abb214e143b
rh-sso7-liquibase-core-3.4.1-2.redhat_2.1.jbcs.el6.noarch.rpm	SHA-256: 5ab18bd5c170619ad632e7981b5bbc7c7f72e975af180dbb82e91597c66e3788
rh-sso7-python-javapackages-3.4.1-5.15.3.jbcs.el6.noarch.rpm	SHA-256: ed2f2821fcf2ab52dea84e9d557d63cb2c55eb1c99043e7c4d9a91ea185bb69e
rh-sso7-runtime-1-2.jbcs.el6.x86_64.rpm	SHA-256: 0a5f499e901f2c3e21639404c51bd46db46053a6676d9f51b1d862736dd375c7
rh-sso7-twitter4j-4.0.4-1.redhat_3.1.jbcs.el6.noarch.rpm	SHA-256: 0762d99e2150dc0b1b12926edcaaeeffc94c90d4429d07e4d56f9dd224eaf7d7
rh-sso7-twitter4j-core-4.0.4-1.redhat_3.1.jbcs.el6.noarch.rpm	SHA-256: 1b3d56f62fae674a3b6ba8a4f3eefc1330f52755e7f6dd20ac135f26ee5a6439
rh-sso7-zxing-3.2.1-1.redhat_4.1.jbcs.el6.noarch.rpm	SHA-256: 2e25f2cfbb56f70ef12ad514fd838cd39407fbfc176b53a045158686cf6673a9
rh-sso7-zxing-core-3.2.1-1.redhat_4.1.jbcs.el6.noarch.rpm	SHA-256: d88e5c674ea00f4c8aca6fccd35a7373bb53a377c1e880dc566ea8ab1087662b
rh-sso7-zxing-javase-3.2.1-1.redhat_4.1.jbcs.el6.noarch.rpm	SHA-256: 67ff6c15f929839282ba1fd2a56d2666f1bc55a3427298905e8b5c4d0da4081c