Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.2.6 security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-adapter-core (4.2.0.final) +64 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (4.2.0.final)

org.keycloak:keycloak-core MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.1.3.final, <=1.2.1.final), io.apiman:apiman-manager-api-security (>=1.1.2.final, <=1.1.3.final) +82 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (1.2.0.cr1)

org.keycloak:keycloak-core MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.1.3.final, =1.1.2.final, =1.1.2.final,...

org.keycloak:keycloak-adapter-core (2.5.0.cr1), org.keycloak:keycloak-admin-client (2.5.0.cr1) +52 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (2.5.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.0.cr1 - org.keycloak:keycloak-admin-client 2.5.0.cr1 -...

org.keycloak:keycloak-account-api (1.0.1.final), org.keycloak:keycloak-account-freemarker (1.0.1.final) +48 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (1.0.1.final)

org.keycloak:keycloak-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.1.final - org.keycloak:keycloak-account-freemarker 1.0.1.final ...

io.hawt:hawtio-app (>=2.0-beta-2, <=2.8.0), io.hawt:hawtio-maven-plugin (>=2.0-beta-2, <=2.8.0) +62 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (3.4.1.final)

org.keycloak:keycloak-core MAVEN version 3.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.hawt:hawtio-app =2.0-beta-2, =2.0-beta-2, =2.8.0 - org.keycloak:keycloak-adapter-core 3.4.1.final ...

org.keycloak:keycloak-account-api (1.7.0.cr1), org.keycloak:keycloak-account-freemarker (1.7.0.cr1) +80 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (1.7.0.cr1)

org.keycloak:keycloak-core MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.7.0.cr1 - org.keycloak:keycloak-account-freemarker 1.7.0.cr1 -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.6.0), org.hawkular.accounts:hawkular-accounts (>=2.0.18.final, <=2.0.19.final) +89 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (1.8.0.final)

org.keycloak:keycloak-core MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.6.0 - org.hawkular.accounts:hawkular-accounts...

org.jenkins-ci.plugins:keycloak (2.0.3), org.keycloak:keycloak-adapter-core (3.2.0.final) +58 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (3.2.0.final)

org.keycloak:keycloak-core MAVEN version 3.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jenkins-ci.plugins:keycloak 2.0.3 - org.keycloak:keycloak-adapter-core 3.2.0.final -...

org.keycloak:keycloak-adapter-core (2.3.0.final), org.keycloak:keycloak-admin-client (2.3.0.final) +51 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (2.3.0.final)

org.keycloak:keycloak-core MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.3.0.final - org.keycloak:keycloak-admin-client 2.3.0.final -...

com.canoo.dolphin-platform:dolphin-platform-security-client (>=0.19.0, <=1.0.0.cr3), de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20) +68 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (3.1.0.final)

org.keycloak:keycloak-core MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-security-client =0.19.0, =1.3.0, =1.3.0, =2.2.3 -...

org.jboss.aerogear.unifiedpush:unifiedpush-service (1.2.3.final), org.keycloak:keycloak-adapter-core (3.4.2.final) +57 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (3.4.2.final)

org.keycloak:keycloak-core MAVEN version 3.4.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-service 1.2.3.final - org.keycloak:keycloak-adapter-core...

org.hawkular.accounts:hawkular-accounts (>=2.0.14.final, <=2.0.17.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.14.final, <=2.0.17.final) +91 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (1.8.0.cr3)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.14.final, =2.0.14.final, =2.0.14.final, =2.0.14.final,...

com.premiumminds.flowable:flowable-keycloak (1.5), de.adorsys.keycloak:user-secret-adapter-common (1.0.7) +79 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (7.0.0)

org.keycloak:keycloak-core MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.premiumminds.flowable:flowable-keycloak 1.5 - de.adorsys.keycloak:user-secret-adapter-common 1.0.7 -...

org.keycloak:keycloak-adapter-core (4.7.0.final), org.keycloak:keycloak-admin-client (4.7.0.final) +63 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (4.7.0.final)

org.keycloak:keycloak-core MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 4.7.0.final - org.keycloak:keycloak-admin-client 4.7.0.final -...

org.keycloak:keycloak-account-api (1.0-beta-1), org.keycloak:keycloak-account-freemarker (1.0-beta-1) +38 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (1.0-beta-1)

org.keycloak:keycloak-core MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-beta-1 - org.keycloak:keycloak-account-freemarker 1.0-beta-1 -...

org.fintrace:keycloak-event-receiver-common (0.0.1), org.fintrace:keycloak-event-receiver-http (0.0.1) +59 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (4.0.0.beta1)

org.keycloak:keycloak-core MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.fintrace:keycloak-event-receiver-common 0.0.1 - org.fintrace:keycloak-event-receiver-http 0.0.1 -...

org.jboss.aerogear.test:aerogear-ups-rest-api (>=1.0.0.beta1, <=1.0.0.beta2), org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1) +43 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (1.0-beta-3)

org.keycloak:keycloak-core MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.test:aerogear-ups-rest-api =1.0.0.beta1, =0.11.0, =0.11.0, =0.11.0, =1.0.0.beta1 -...

com.mjamsek.auth:kee-auth (1.0.0), de.retest:recheck (>=1.6.0-beta.1, <=1.7.0) +105 more potentially affected by CVE-2020-1697 via org.keycloak:keycloak-core (7.0.1)

org.keycloak:keycloak-core MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.mjamsek.auth:kee-auth 1.0.0 - de.retest:recheck =1.6.0-beta.1, =1.6.0-beta.1, =1.6.0-beta.1,...