Issued:
2019-10-14
Updated:
2019-10-14

RHSA-2019:3049 - Security Advisory

Synopsis

Low: RH-SSO 7.3.4 adapters for Enterprise Application Platform 7.2 security update

Type/Severity

Security Advisory: Low

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat Single Sign-On 7.3.4 adapters are now available for Red Hat JBoss Enterprise Application Platform 7.2

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

These packages provide security updates to adapters for use with Red Hat Single Sign-On 7.3.4 for Red Hat JBoss Enterprise Application Platform 7.2.

Security Fix(es):

  • keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.4 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.3 for RHEL 6 x86_64
  • JBoss Enterprise Application Platform 7.2 for RHEL 8 x86_64
  • JBoss Enterprise Application Platform 7.2 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 7.2 for RHEL 6 x86_64

Fixes

  • BZ - 1649870 - CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs

JBoss Enterprise Application Platform 7.4 for RHEL 8

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: fd3b7845f4323530831e9ea55afbbe860bda8377e284c87a5a2bd6b091f0e035
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: cf3ecda7145e7bfec79e1cd1597f66b31e6d9618d9b72ecebc49656d4f59b3ea
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7841735ff9fd4d02d83bcc0be31330e91f43ff98b6bc76460e9f1857ce4f48de

JBoss Enterprise Application Platform 7.4 for RHEL 7

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: c570e830e47298f8925748b79cac91166520876014890ad0b0031579fe62b9c7
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1987459a58bfac47cd8cd3ae3fb919d5f5ce237ff9d2dc1ca8ecb49504bf8d01
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 509bd0db8aca82f4205d9f74c4e02036116c670b69ba160a18649707bd2bbda8

JBoss Enterprise Application Platform 7.3 for RHEL 8

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: fd3b7845f4323530831e9ea55afbbe860bda8377e284c87a5a2bd6b091f0e035
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: cf3ecda7145e7bfec79e1cd1597f66b31e6d9618d9b72ecebc49656d4f59b3ea
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7841735ff9fd4d02d83bcc0be31330e91f43ff98b6bc76460e9f1857ce4f48de

JBoss Enterprise Application Platform 7.3 for RHEL 7

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: c570e830e47298f8925748b79cac91166520876014890ad0b0031579fe62b9c7
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1987459a58bfac47cd8cd3ae3fb919d5f5ce237ff9d2dc1ca8ecb49504bf8d01
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 509bd0db8aca82f4205d9f74c4e02036116c670b69ba160a18649707bd2bbda8

JBoss Enterprise Application Platform 7.3 for RHEL 6

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 323926598b01d8eea6267f8b1876c39f4878d3f43d1a41ce65772de15031409b
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 1f229fe9c3ecf07c591fb1255cc2b30f4a7588d1042ed5bcc9326eaae002f306
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 19ce96441f47ac4a2c6e4ed4aab8aab58068fe1538a3f131fe3149f4ee8553ce

JBoss Enterprise Application Platform 7.2 for RHEL 8

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: fd3b7845f4323530831e9ea55afbbe860bda8377e284c87a5a2bd6b091f0e035
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: cf3ecda7145e7bfec79e1cd1597f66b31e6d9618d9b72ecebc49656d4f59b3ea
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7841735ff9fd4d02d83bcc0be31330e91f43ff98b6bc76460e9f1857ce4f48de

JBoss Enterprise Application Platform 7.2 for RHEL 7

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.src.rpm SHA-256: c570e830e47298f8925748b79cac91166520876014890ad0b0031579fe62b9c7
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 1987459a58bfac47cd8cd3ae3fb919d5f5ce237ff9d2dc1ca8ecb49504bf8d01
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el7eap.noarch.rpm SHA-256: 509bd0db8aca82f4205d9f74c4e02036116c670b69ba160a18649707bd2bbda8

JBoss Enterprise Application Platform 7.2 for RHEL 6

SRPM
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap.src.rpm SHA-256: 323926598b01d8eea6267f8b1876c39f4878d3f43d1a41ce65772de15031409b
x86_64
eap7-keycloak-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 1f229fe9c3ecf07c591fb1255cc2b30f4a7588d1042ed5bcc9326eaae002f306
eap7-keycloak-saml-adapter-sso7_3-4.8.13-1.Final_redhat_00001.1.el6eap.noarch.rpm SHA-256: 19ce96441f47ac4a2c6e4ed4aab8aab58068fe1538a3f131fe3149f4ee8553ce

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.