drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Red Hat Single Sign-On
Name: |
Mehrere Probleme in Red Hat Single Sign-On |
|
ID: |
RHSA-2019:0380-01 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat Single Sign-On |
|
Datum: |
Di, 19. Februar 2019, 19:10 |
|
Referenzen: |
https://access.redhat.com/security/cve/CVE-2018-10934
https://access.redhat.com/security/cve/CVE-2018-14642
https://access.redhat.com/security/cve/CVE-2018-1000632
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=core.service.rhsso&version=7.2 |
|
Applikationen: |
Red Hat Single Sign-On |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: Red Hat Single Sign-On 7.2.6 security update Advisory ID: RHSA-2019:0380-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2019:0380 Issue date: 2019-02-19 CVE Names: CVE-2018-10934 CVE-2018-14642 CVE-2018-1000632 =====================================================================
1. Summary:
A security update is now available for Red Hat Single Sign-On 7.2 from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
2. Description:
Red Hat Single Sign-On 7.2 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.2.6 serves as a replacement for Red Hat Single Sign-On 7.2.5, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer (CVE-2018-14642)
* console: wildfly-core: Cross-site scripting (XSS) in JBoss Management Console (CVE-2018-10934)
* dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents (CVE-2018-1000632)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
3. Solution:
Before applying the update, back up your existing installation, including all applications, configuration files, and databases and database settings.
The References section of this erratum contains a download link. You must log in to download the update.
4. Bugs fixed (https://bugzilla.redhat.com/):
1615673 - CVE-2018-10934 wildfly-core: Cross-site scripting (XSS) in JBoss Management Console 1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents 1628702 - CVE-2018-14642 undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer
5. References:
https://access.redhat.com/security/cve/CVE-2018-10934 https://access.redhat.com/security/cve/CVE-2018-14642 https://access.redhat.com/security/cve/CVE-2018-1000632 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=core.service.rhsso&version=7.2 https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.2/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXGw6jNzjgjWX9erEAQimzw/+KDUSNJZ/cUPtEzADZUJLdyjIA1dgMVvh I5/yy1AXUareTtzEy28n+vgfyXwlib/hL7lvIxZh+UIOUzzYdAzlCWNuQgRe6xnA Cv1gByKfsWDJHjCJgxXG9rwKzzip55LcswDMN8dq45Scx4SfHI1ZPDt/JkVOIgxf ohoiTgrmUOQT/Lyg3R2DxPooEaAkuSbvOdPgyVpImkKwMr14WpiY108BiGJmDYkS Vj1XkiDDJpEiMyDsar8MMWVx4Hu+de6+l86xn2jDGGuuGRa0Vn+63ahKcNl96txS SQ1PIeMSWvy4ussY+JxUr3eKq/D68g4FZ+U9eQv4QiSYZtCX4DQoflGLuEYsOas8 +dVOKU7FLuo/i+a/6hMQTXY0/rVO3yhR9EFWhxDZCTJ5qaJV0A37QJR2k28tJM/1 iI09WJx6EpRqb1VZWSqfTN8VRBoQ+httEKGJRsl/9kOWP4RtL8W69vJfc8tbJCbs btw8VM+EEnz6QqMkNpsTdMuyVy709QgXBwFpg5kvOtv0/E7Ksj7Bprg6GyL/GSKC PR9jZxPrI1WwTP3M41IfRWcM3RBB7cV68ZpHqhp83zbDmdwTacGZ311oWrtN8Pmf vCUL4HkFABL+gA7BMRcFzOzLgf1nYT8qTDIiLngH0dXjsftNEyaNIIIYVaQqEQFc euNn279sNms= =3rZE -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
|
|
|
|