SynopsisThe remote Red Hat host is missing one or more security updates.
DescriptionNew Red Hat Single Sign-On 7.3.5 packages are now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.3.5 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es) :
* keycloak: Service accounts reset password flow not using placeholder.org domain anymore (CVE-2019-14837)
* undertow: HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)
* undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)
* undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)
* wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default (CVE-2019-14838)
* wildfly: wildfly-security-manager: security manager authorization bypass (CVE-2019-14843)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
SolutionUpdate the affected rh-sso7-keycloak and / or rh-sso7-keycloak-server packages.
File Name: redhat-RHSA-2019-4042.nasl
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent
Temporal Vector: E:U/RL:OF/RC:C
Temporal Vector: E:U/RL:O/RC:C
CPE: p-cpe:/a:redhat:enterprise_linux:rh-sso7-keycloak, p-cpe:/a:redhat:enterprise_linux:rh-sso7-keycloak-server, cpe:/o:redhat:enterprise_linux:8
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 12/2/2019
Vulnerability Publication Date: 8/13/2019