{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update is now available for Red Hat OpenShift Application Runtimes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.\n\nThis release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\n* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)\n\n* keycloak: session hijack using the user access token (CVE-2019-3868)\n\n* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2020:2366",
            url: "https://access.redhat.com/errata/RHSA-2020:2366",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/",
            url: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/",
         },
         {
            category: "external",
            summary: "1729261",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261",
         },
         {
            category: "external",
            summary: "1749487",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12",
         },
         {
            category: "external",
            summary: "1679144",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144",
         },
         {
            category: "external",
            summary: "1690628",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628",
         },
         {
            category: "external",
            summary: "1693325",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325",
         },
         {
            category: "external",
            summary: "1728609",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2366.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update",
      tracking: {
         current_release_date: "2025-04-09T17:29:01+00:00",
         generator: {
            date: "2025-04-09T17:29:01+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2020:2366",
         initial_release_date: "2020-06-04T13:06:31+00:00",
         revision_history: [
            {
               date: "2020-06-04T13:06:31+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2020-06-04T13:06:31+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-09T17:29:01+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Runtimes Spring Boot 2.1.12",
                        product: {
                           name: "Red Hat Runtimes Spring Boot 2.1.12",
                           product_id: "Red Hat Runtimes Spring Boot 2.1.12",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:openshift_application_runtimes:1.0",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat OpenShift Application Runtimes",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2019-0199",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2019-03-26T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1693325",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "tomcat: Apache Tomcat HTTP/2 DoS",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "pki-servlet-container does not use HTTP/2 in its default configuration.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Runtimes Spring Boot 2.1.12",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-0199",
            },
            {
               category: "external",
               summary: "RHBZ#1693325",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-0199",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199",
            },
         ],
         release_date: "2019-03-25T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2020-06-04T13:06:31+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2020:2366",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "tomcat: Apache Tomcat HTTP/2 DoS",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Caranzo Gideon",
                  "Muzamil Muein",
                  "Siddiqui Najam",
               ],
               organization: "Gemalto E&C",
            },
         ],
         cve: "CVE-2019-3868",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-02-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1679144",
            },
         ],
         notes: [
            {
               category: "description",
               text: "Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: session hijack using the user access token",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Runtimes Spring Boot 2.1.12",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-3868",
            },
            {
               category: "external",
               summary: "RHBZ#1679144",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-3868",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-3868",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868",
            },
         ],
         release_date: "2019-04-23T16:59:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2020-06-04T13:06:31+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2020:2366",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.8,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: session hijack using the user access token",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Marek Posolda",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2019-3875",
         cwe: {
            id: "CWE-295",
            name: "Improper Certificate Validation",
         },
         discovery_date: "2019-03-19T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1690628",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: missing signatures validation on CRL used to verify client certificates",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Runtimes Spring Boot 2.1.12",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-3875",
            },
            {
               category: "external",
               summary: "RHBZ#1690628",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-3875",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-3875",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875",
            },
         ],
         release_date: "2019-06-11T14:22:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2020-06-04T13:06:31+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2020:2366",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: missing signatures validation on CRL used to verify client certificates",
      },
      {
         cve: "CVE-2019-10199",
         cwe: {
            id: "CWE-352",
            name: "Cross-Site Request Forgery (CSRF)",
         },
         discovery_date: "2019-07-04T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1729261",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: CSRF check missing in My Resources functionality in the Account Console",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Runtimes Spring Boot 2.1.12",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10199",
            },
            {
               category: "external",
               summary: "RHBZ#1729261",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10199",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10199",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199",
            },
         ],
         release_date: "2019-08-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2020-06-04T13:06:31+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2020:2366",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: CSRF check missing in My Resources functionality in the Account Console",
      },
      {
         cve: "CVE-2019-10201",
         cwe: {
            id: "CWE-287",
            name: "Improper Authentication",
         },
         discovery_date: "2019-07-05T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1728609",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Runtimes Spring Boot 2.1.12",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10201",
            },
            {
               category: "external",
               summary: "RHBZ#1728609",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10201",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10201",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201",
            },
         ],
         release_date: "2019-08-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2020-06-04T13:06:31+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2020:2366",
            },
            {
               category: "workaround",
               details: "Administrator can prevent this issue for POST binding by requiring signed assertions.",
               product_ids: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation",
      },
      {
         cve: "CVE-2019-14832",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         discovery_date: "2019-07-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1749487",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: cross-realm user access auth bypass",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Runtimes Spring Boot 2.1.12",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14832",
            },
            {
               category: "external",
               summary: "RHBZ#1749487",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
            },
         ],
         release_date: "2019-10-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2020-06-04T13:06:31+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2020:2366",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "Red Hat Runtimes Spring Boot 2.1.12",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: cross-realm user access auth bypass",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "New Red Hat Single Sign-On 7.3.4 packages are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.3.4 on RHEL 6 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\n* keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message (CVE-2019-12814)\n\n* jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server (CVE-2019-12086)\n\n* undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2019:3044",
            url: "https://access.redhat.com/errata/RHSA-2019:3044",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/",
            url: "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/",
         },
         {
            category: "external",
            summary: "1649870",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1649870",
         },
         {
            category: "external",
            summary: "1713068",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
         },
         {
            category: "external",
            summary: "1713468",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
         },
         {
            category: "external",
            summary: "1725795",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
         },
         {
            category: "external",
            summary: "1737517",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
         },
         {
            category: "external",
            summary: "1749487",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
         },
         {
            category: "external",
            summary: "KEYCLOAK-11454",
            url: "https://issues.redhat.com/browse/KEYCLOAK-11454",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3044.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 6",
      tracking: {
         current_release_date: "2025-04-09T17:26:20+00:00",
         generator: {
            date: "2025-04-09T17:26:20+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2019:3044",
         initial_release_date: "2019-10-14T18:29:48+00:00",
         revision_history: [
            {
               date: "2019-10-14T18:29:48+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-10-14T18:29:48+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-09T17:26:20+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Single Sign-On 7.3 for RHEL 6 Server",
                        product: {
                           name: "Red Hat Single Sign-On 7.3 for RHEL 6 Server",
                           product_id: "6Server-RHSSO-7.3",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:red_hat_single_sign_on:7::el6",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Single Sign-On",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                        product: {
                           name: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                           product_id: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak@4.8.13-1.Final_redhat_00001.1.el6sso?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                        product: {
                           name: "rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                           product_id: "rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak-server@4.8.13-1.Final_redhat_00001.1.el6sso?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                        product: {
                           name: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                           product_id: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak@4.8.13-1.Final_redhat_00001.1.el6sso?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch as a component of Red Hat Single Sign-On 7.3 for RHEL 6 Server",
               product_id: "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            },
            product_reference: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            relates_to_product_reference: "6Server-RHSSO-7.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src as a component of Red Hat Single Sign-On 7.3 for RHEL 6 Server",
               product_id: "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
            },
            product_reference: "rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
            relates_to_product_reference: "6Server-RHSSO-7.3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch as a component of Red Hat Single Sign-On 7.3 for RHEL 6 Server",
               product_id: "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            },
            product_reference: "rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            relates_to_product_reference: "6Server-RHSSO-7.3",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Christian Schlüter",
               ],
               organization: "Viada",
            },
         ],
         cve: "CVE-2019-10184",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2019-03-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713068",
            },
         ],
         notes: [
            {
               category: "description",
               text: "undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "undertow: Information leak in requests for directories without trailing slashes",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10184",
            },
            {
               category: "external",
               summary: "RHBZ#1713068",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
            },
         ],
         release_date: "2019-07-24T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:29:48+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3044",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "undertow: Information leak in requests for directories without trailing slashes",
      },
      {
         cve: "CVE-2019-12086",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-05-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713468",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12086",
            },
            {
               category: "external",
               summary: "RHBZ#1713468",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
            },
         ],
         release_date: "2019-05-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:29:48+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3044",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
      },
      {
         cve: "CVE-2019-12814",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-06-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1725795",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "* Red Hat Satellite 6 does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. \n* Red Hat OpenStack's OpenDaylight does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12814",
            },
            {
               category: "external",
               summary: "RHBZ#1725795",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
            },
         ],
         release_date: "2019-06-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:29:48+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3044",
            },
            {
               category: "workaround",
               details: "This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application's ClassPath.  Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability.",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
      },
      {
         cve: "CVE-2019-14379",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2019-07-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1737517",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: default typing mishandling leading to remote code execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nSimilarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14379",
            },
            {
               category: "external",
               summary: "RHBZ#1737517",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
            },
         ],
         release_date: "2019-07-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:29:48+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3044",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "jackson-databind: default typing mishandling leading to remote code execution",
      },
      {
         cve: "CVE-2019-14820",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2018-11-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1649870",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: adapter endpoints are exposed via arbitrary URLs",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14820",
            },
            {
               category: "external",
               summary: "RHBZ#1649870",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1649870",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14820",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14820",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14820",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14820",
            },
         ],
         release_date: "2019-10-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:29:48+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3044",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "keycloak: adapter endpoints are exposed via arbitrary URLs",
      },
      {
         cve: "CVE-2019-14832",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         discovery_date: "2019-07-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1749487",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: cross-realm user access auth bypass",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
               "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14832",
            },
            {
               category: "external",
               summary: "RHBZ#1749487",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
            },
         ],
         release_date: "2019-10-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:29:48+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3044",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-0:4.8.13-1.Final_redhat_00001.1.el6sso.src",
                  "6Server-RHSSO-7.3:rh-sso7-keycloak-server-0:4.8.13-1.Final_redhat_00001.1.el6sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: cross-realm user access auth bypass",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.3.4 serves as a replacement for Red Hat Single Sign-On 7.2.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\n* keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message (CVE-2019-12814)\n\n* jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server (CVE-2019-12086)\n\n* undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2019:3050",
            url: "https://access.redhat.com/errata/RHSA-2019:3050",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.3",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.3",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/",
            url: "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/",
         },
         {
            category: "external",
            summary: "1649870",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1649870",
         },
         {
            category: "external",
            summary: "1713068",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
         },
         {
            category: "external",
            summary: "1713468",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
         },
         {
            category: "external",
            summary: "1725795",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
         },
         {
            category: "external",
            summary: "1737517",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
         },
         {
            category: "external",
            summary: "1749487",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
         },
         {
            category: "external",
            summary: "KEYCLOAK-11367",
            url: "https://issues.redhat.com/browse/KEYCLOAK-11367",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3050.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update",
      tracking: {
         current_release_date: "2025-04-09T17:26:38+00:00",
         generator: {
            date: "2025-04-09T17:26:38+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2019:3050",
         initial_release_date: "2019-10-14T18:59:06+00:00",
         revision_history: [
            {
               date: "2019-10-14T18:59:06+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-10-14T18:59:06+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-09T17:26:38+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Single Sign-On 7.3.4 zip",
                        product: {
                           name: "Red Hat Single Sign-On 7.3.4 zip",
                           product_id: "Red Hat Single Sign-On 7.3.4 zip",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_single_sign_on:7.3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Single Sign-On",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Bart Toersche",
               ],
               organization: "Simacan",
            },
         ],
         cve: "CVE-2019-10169",
         cwe: {
            id: "CWE-267",
            name: "Privilege Defined With Unsafe Actions",
         },
         discovery_date: "2019-05-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1721302",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: script execution via UMA policy trigger",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10169",
            },
            {
               category: "external",
               summary: "RHBZ#1721302",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1721302",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10169",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10169",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10169",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10169",
            },
         ],
         release_date: "2020-04-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: script execution via UMA policy trigger",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Bart Toersche",
               ],
               organization: "Simacan",
            },
         ],
         cve: "CVE-2019-10170",
         cwe: {
            id: "CWE-267",
            name: "Privilege Defined With Unsafe Actions",
         },
         discovery_date: "2019-05-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1721295",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: script execution via realm management policy trigger",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10170",
            },
            {
               category: "external",
               summary: "RHBZ#1721295",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1721295",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10170",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10170",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10170",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10170",
            },
         ],
         release_date: "2020-04-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: script execution via realm management policy trigger",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Christian Schlüter",
               ],
               organization: "Viada",
            },
         ],
         cve: "CVE-2019-10184",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2019-03-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713068",
            },
         ],
         notes: [
            {
               category: "description",
               text: "undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "undertow: Information leak in requests for directories without trailing slashes",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10184",
            },
            {
               category: "external",
               summary: "RHBZ#1713068",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
            },
         ],
         release_date: "2019-07-24T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "undertow: Information leak in requests for directories without trailing slashes",
      },
      {
         cve: "CVE-2019-10212",
         cwe: {
            id: "CWE-532",
            name: "Insertion of Sensitive Information into Log File",
         },
         discovery_date: "2019-07-22T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1731984",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "All the Red Hat products using the undertow-core jar version 2.0.20 or before are affected.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10212",
            },
            {
               category: "external",
               summary: "RHBZ#1731984",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1731984",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10212",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10212",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10212",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10212",
            },
         ],
         release_date: "2019-09-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "Use Elytron instead of legacy Security subsystem.",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files",
      },
      {
         cve: "CVE-2019-12086",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-05-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713468",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12086",
            },
            {
               category: "external",
               summary: "RHBZ#1713468",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
            },
         ],
         release_date: "2019-05-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
      },
      {
         cve: "CVE-2019-12814",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-06-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1725795",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "* Red Hat Satellite 6 does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. \n* Red Hat OpenStack's OpenDaylight does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12814",
            },
            {
               category: "external",
               summary: "RHBZ#1725795",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
            },
         ],
         release_date: "2019-06-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application's ClassPath.  Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability.",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
      },
      {
         cve: "CVE-2019-14379",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2019-07-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1737517",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: default typing mishandling leading to remote code execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nSimilarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14379",
            },
            {
               category: "external",
               summary: "RHBZ#1737517",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
            },
         ],
         release_date: "2019-07-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "jackson-databind: default typing mishandling leading to remote code execution",
      },
      {
         cve: "CVE-2019-14820",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2018-11-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1649870",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: adapter endpoints are exposed via arbitrary URLs",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14820",
            },
            {
               category: "external",
               summary: "RHBZ#1649870",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1649870",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14820",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14820",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14820",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14820",
            },
         ],
         release_date: "2019-10-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "keycloak: adapter endpoints are exposed via arbitrary URLs",
      },
      {
         cve: "CVE-2019-14832",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         discovery_date: "2019-07-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1749487",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: cross-realm user access auth bypass",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14832",
            },
            {
               category: "external",
               summary: "RHBZ#1749487",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
            },
         ],
         release_date: "2019-10-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: cross-realm user access auth bypass",
      },
   ],
}