(RHSA-2017:1203) Important: Red Hat Single Sign-On Node.js adapter security update

Red Hat Single Sign-On 7.1 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. The Node.js adapter provides a simple module for authentication and authorization in Node.js applications.

This asynchronous patch is a security update for the Node.js adapter for Red Hat Single Sign-On 7.1.

Security Fix(es):

• It was found that the Keycloak Node.js adapter did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks. (CVE-2017-7474)

Red Hat would like to thank Nick Shearer (Quest) for reporting this issue.