RHEL 8 : Red Hat Single Sign-On 7.4.9 security update on RHEL 8 (Moderate) (RHSA-2021:3529)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3529 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), de.retest:recheck (>=1.2.0-beta.1, <=1.4.0) +83 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (6.0.1)

org.keycloak:keycloak-core MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =1.2.0-beta.1, =1.3.0-beta.1, =0.0.7, =0.0.7, =0.0.6,...

com.premiumminds.flowable:flowable-keycloak (1.5), de.adorsys.keycloak:user-secret-adapter-common (1.0.7) +79 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (7.0.0)

org.keycloak:keycloak-core MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.premiumminds.flowable:flowable-keycloak 1.5 - de.adorsys.keycloak:user-secret-adapter-common 1.0.7 -...

com.mjamsek.auth:kee-auth (1.0.0), de.retest:recheck (>=1.6.0-beta.1, <=1.7.0) +105 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (7.0.1)

org.keycloak:keycloak-core MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.mjamsek.auth:kee-auth 1.0.0 - de.retest:recheck =1.6.0-beta.1, =1.6.0-beta.1, =1.6.0-beta.1,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.3), com.github.vzakharchenko:cisco-radius-plugin (1.3.3) +98 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (12.0.2)

org.keycloak:keycloak-core MAVEN version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.3 - com.github.vzakharchenko:cisco-radius-plugin 1.3...

com.github.vzakharchenko:keycloak-plugins (>=0.1, <=1.0.1), com.github.vzakharchenko:mikrotik-radius-plugin (>=0.1, <=1.0.1) +93 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (8.0.1)

org.keycloak:keycloak-core MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:keycloak-plugins =0.1, =0.1, =0.1, =0.1, =1.8.0-beta.1, =1.8.0-beta.1,...

com.jalalkiswani:smart-cloud-service (>=5.0.0, <=5.1.0), com.jalalkiswani:smart-cloud-service-crosscutting (5.1.0) +78 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (11.0.3)

org.keycloak:keycloak-core MAVEN version 11.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.jalalkiswani:smart-cloud-service =5.0.0, =5.0.0, =5.0.0, =1.10.0.final, =1.10.0.final, =1.11.7.final a...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.2.9, <=1.3.0), com.github.vzakharchenko:cisco-radius-plugin (>=1.2.9, <=1.3.0) +88 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (12.0.0)

org.keycloak:keycloak-core MAVEN version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9,...

com.c4-soft.springaddons:spring-security-oauth2-test-addons (>=2.0.0, <=2.0.3), com.c4-soft.springaddons:spring-security-oauth2-test-webflux-addons (>=2.0.0, <=2.0.3) +67 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (9.0.0)

org.keycloak:keycloak-core MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.c4-soft.springaddons:spring-security-oauth2-test-addons =2.0.0, =2.0.0, =2.0.0, =1.1.0, =1.1.0, =1.1.0,...

com.blazebit:blaze-storage-client-keycloak (>=0.2.0, <=0.3.3), com.blazebit:blaze-storage-modules-authentication-keycloak (>=0.2.0, <=0.3.3) +77 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (1.1.0.final)

org.keycloak:keycloak-core MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.blazebit:blaze-storage-client-keycloak =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.16.1, =1.1.0.rc3,...

org.keycloak:keycloak-adapter-core (3.0.0.cr1), org.keycloak:keycloak-admin-client (3.0.0.cr1) +55 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (3.0.0.cr1)

org.keycloak:keycloak-core MAVEN version 3.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 3.0.0.cr1 - org.keycloak:keycloak-admin-client 3.0.0.cr1 -...

com.canoo.dolphin-platform:dolphin-platform-security-server (>=0.19.0, <=1.0.0.cr3), com.canoo.dolphin-platform:dolphin-platform-security-server-javaee (>=0.19.0, <=1.0.0.cr3) +61 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (3.0.0.final)

org.keycloak:keycloak-core MAVEN version 3.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-security-server =0.19.0, =0.19.0, =0.19.0, =1.0.0.cr3 -...

org.keycloak:keycloak-adapter-core (3.1.0.cr1), org.keycloak:keycloak-admin-client (3.1.0.cr1) +56 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (3.1.0.cr1)

org.keycloak:keycloak-core MAVEN version 3.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 3.1.0.cr1 - org.keycloak:keycloak-admin-client 3.1.0.cr1 -...

org.keycloak:keycloak-adapter-core (3.2.0.cr1), org.keycloak:keycloak-admin-client (3.2.0.cr1) +56 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (3.2.0.cr1)

org.keycloak:keycloak-core MAVEN version 3.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 3.2.0.cr1 - org.keycloak:keycloak-admin-client 3.2.0.cr1 -...

org.keycloak:keycloak-adapter-core (2.5.1.final), org.keycloak:keycloak-admin-client (2.5.1.final) +52 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (2.5.1.final)

org.keycloak:keycloak-core MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.1.final - org.keycloak:keycloak-admin-client 2.5.1.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.9.1), org.keycloak:keycloak-adapter-core (2.5.4.final) +54 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (2.5.4.final)

org.keycloak:keycloak-core MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.9.1 - org.keycloak:keycloak-adapter-core 2.5.4.fin...

io.apicurio:apicurio-studio-be-hub-api (0.2.15.final), io.apicurio:apicurio-studio-fe-servlet (0.2.15.final) +66 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (4.1.0.final)

org.keycloak:keycloak-core MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apicurio:apicurio-studio-be-hub-api 0.2.15.final - io.apicurio:apicurio-studio-fe-servlet...

com.github.bogad:itarone-keycloak-starter (>=2.0.0, <=2.1.2), de.samply:auth-client (4.0.1) +65 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (4.0.0.final)

org.keycloak:keycloak-core MAVEN version 4.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.bogad:itarone-keycloak-starter =2.0.0, =2.1.2 - de.samply:auth-client 4.0.1 -...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), io.github.pablobastidasv:kc (1.3) +77 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (4.5.0.final)

org.keycloak:keycloak-core MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final - io.github.pablobastidasv:kc 1.3 -...

org.keycloak:keycloak-adapter-core (4.7.0.final), org.keycloak:keycloak-admin-client (4.7.0.final) +63 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (4.7.0.final)

org.keycloak:keycloak-core MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 4.7.0.final - org.keycloak:keycloak-admin-client 4.7.0.final -...