(RHSA-2021:5170) Moderate: Red Hat Single Sign-On 7.4.10 security update

Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.4.10 serves as a replacement for Red Hat Single Sign-On 7.4.9, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

• undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

• wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

• wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users (CVE-2021-3717)

• jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

• xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

• resteasy: Error message exposes endpoint class information (CVE-2021-20289)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.