RHEL 7 : Red Hat Single Sign-On 7.6.3 security update on RHEL 7 (Moderate) (RHSA-2023:2705)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2705 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8

New Red Hat Single Sign-On 7.6.3 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9

New Red Hat Single Sign-On 7.6.3 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7

New Red Hat Single Sign-On 7.6.3 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produc...

Streams: component version with information disclosure flaw

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

CVE-2023-0833

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 XP 4.0.0.GA Security release

JBoss EAP XP 4.0.0.GA Security release on the EAP 7.4.9 base. See references for release notes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Security Bulletin: IBM Planning Analytics Workspace is affected by multiple vulnerabilities (CVE-2021-40690, CVE-2022-25647, XFID: 233967)

Summary IBM Planning Analytics Workspace is affected by multiple vulnerabilities. Apache Santuario Security for Java provides a mechanism for XML-Signature & XML Encryption syntax and processing CVE-2021-40690. Google Gson is an open-source Java library to serialize and deserialize Java objects t...

OKHttp Square Authentication Bypass Man-in-the-Middle

The vulnerability of the client’s HTTP library, OKHttp Square, is related to errors in the certificate authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute a type of “man-in-the-middle” attack...

GHSA-3CQM-MF7H-PRRJ Square OkHttp can accept the wrong certificate

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

com.github.bumptech.glide:okhttp3-integration (1.5.0), com.squareup.okhttp3.sample:crawler (3.1.0) +12 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.1.0)

com.squareup.okhttp3:okhttp MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.github.bumptech.glide:okhttp3-integration 1.5.0 - com.squareup.okhttp3.sample:crawler 3.1.0 -...

com.barchart:barchart-streaming-client (>=0.2.0, <=0.2.1), com.baulsupp:oksocial (>=1.0.1, <=1.0.2) +71 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.0.1)

com.squareup.okhttp3:okhttp MAVEN version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.barchart:barchart-streaming-client =0.2.0, =1.0.1, =2.0.0, =1.0.0, =1.3.0, =2.3.3110302,...

com.appunite:websockets-rxjava (>=4.0.0, <=4.0.1), com.signaturit.api:java-sdk (1.1.5) +13 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.1.1)

com.squareup.okhttp3:okhttp MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.appunite:websockets-rxjava =4.0.0, =4.0.1 - com.signaturit.api:java-sdk 1.1.5 -...

com.apollographql.apollo3:apollo-android-support (>=3.0.0-dev2, <=3.0.0-dev12), com.apollographql.apollo3:apollo-cache-interceptor-jvm (>=3.0.0-dev2, <=3.0.0-dev13) +132 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.12.11)

com.squareup.okhttp3:okhttp MAVEN version 3.12.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - com.apollographql.apollo3:apollo-android-support =3.0.0-dev2, =3.0.0-dev2, =3.0.0-dev2, =3.0.0-alpha01,...

cf.ystapi:ystapi (>=beta-0.0.1.3, <=beta-0.0.1.7), com.easemob.im:im-sdk-core (>=1.0.2, <=1.0.4) +42 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.13.0)

com.squareup.okhttp3:okhttp MAVEN version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - cf.ystapi:ystapi =beta-0.0.1.3, =1.0.2, =0.0.2, =0.0.3 - com.github.v-play-games:bot.commands.mod 0.0.2 ...

ai.deepsense:seahorse-executor-api_2.11 (>=1.4.2, <=1.4.3), ai.deepsense:seahorse-executor-commons_2.11 (>=1.4.2, <=1.4.3) +243 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.2.0)

com.squareup.okhttp3:okhttp MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ai.deepsense:seahorse-executor-api2.11 =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =3.8.2.1, =1.1.6, =0.5.0,...