{
   affected: [
      {
         package: {
            ecosystem: "Maven",
            name: "org.keycloak:keycloak-parent",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     fixed: "19.0.2",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2022-2256",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-79",
      ],
      github_reviewed: true,
      github_reviewed_at: "2022-09-23T16:32:51Z",
      nvd_published_at: null,
      severity: "MODERATE",
   },
   details: "A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (18.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality. \n\n### CVSS 3.1 - **3.8**\n\n**Vector String:** AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N\n\n**Vector Clarification:**\n\n* User interaction is not required as the admin console is regularly used during an administrator's work\n* The scope is unchanged since the admin console web application is both the vulnerable component and where the exploit executes\n\n### Credits\n\nAytaç Kalıncı, Ilker Bulgurcu, Yasin Yılmaz (@aytackalinci, @smileronin, @yasinyilmaz) - NETAŞ PENTEST TEAM\n",
   id: "GHSA-w9mf-83w3-fv49",
   modified: "2022-10-18T17:19:11Z",
   published: "2022-09-23T16:32:51Z",
   references: [
      {
         type: "WEB",
         url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
      },
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
      },
      {
         type: "WEB",
         url: "https://github.com/keycloak/keycloak/commit/8e705a65ab2aa2b079374ec859ee7a75fad5a7d9",
      },
      {
         type: "WEB",
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/keycloak/keycloak",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
         type: "CVSS_V3",
      },
   ],
   summary: "Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles",
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "New Red Hat Single Sign-On 7.5.3 packages are now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.5.3 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.5.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)\n\n* wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled (CVE-2022-0866)\n\n* xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)\n\n* netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n\n* keycloak-saml-core: keycloak: Uploading of SAML javascript protocol mapper scripts through the admin (CVE-2022-2668)\n\n* keycloak: Stored XSS in groups dropdown (CVE-2022-0225)\n\n* h2: Remote Code Execution in Console (CVE-2021-42392)\n\n* keycloak-core: keycloak: improper input validation permits script injection (CVE-2022-2256)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2022:6783",
            url: "https://access.redhat.com/errata/RHSA-2022:6783",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "2031958",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2031958",
         },
         {
            category: "external",
            summary: "2039403",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2039403",
         },
         {
            category: "external",
            summary: "2040268",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2040268",
         },
         {
            category: "external",
            summary: "2060929",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060929",
         },
         {
            category: "external",
            summary: "2064226",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064226",
         },
         {
            category: "external",
            summary: "2064698",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
         },
         {
            category: "external",
            summary: "2101942",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
         },
         {
            category: "external",
            summary: "2115392",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2115392",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6783.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 8",
      tracking: {
         current_release_date: "2025-04-15T10:58:22+00:00",
         generator: {
            date: "2025-04-15T10:58:22+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2022:6783",
         initial_release_date: "2022-10-04T15:35:14+00:00",
         revision_history: [
            {
               date: "2022-10-04T15:35:14+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2022-10-04T15:35:14+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-15T10:58:22+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Single Sign-On 7.5 for RHEL 8",
                        product: {
                           name: "Red Hat Single Sign-On 7.5 for RHEL 8",
                           product_id: "8Base-RHSSO-7.5",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:red_hat_single_sign_on:7.5::el8",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Single Sign-On",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                        product: {
                           name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                           product_id: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak@15.0.8-1.redhat_00001.1.el8sso?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                        product: {
                           name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_id: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak@15.0.8-1.redhat_00001.1.el8sso?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                        product: {
                           name: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_id: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak-server@15.0.8-1.redhat_00001.1.el8sso?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8",
               product_id: "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            },
            product_reference: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            relates_to_product_reference: "8Base-RHSSO-7.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src as a component of Red Hat Single Sign-On 7.5 for RHEL 8",
               product_id: "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
            },
            product_reference: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
            relates_to_product_reference: "8Base-RHSSO-7.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8",
               product_id: "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            },
            product_reference: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            relates_to_product_reference: "8Base-RHSSO-7.5",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-36518",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2022-03-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2064698",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: denial of service via a large depth of nested objects",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "CodeReady Studio is no longer supported and therefore this flaw will not be addressed in CodeReady Studio.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "RHBZ#2064698",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
               url: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
               url: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
            },
         ],
         release_date: "2020-08-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: denial of service via a large depth of nested objects",
      },
      {
         cve: "CVE-2021-42392",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-01-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2039403",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited through various attack vectors, most notably through the H2 Console, which leads to unauthenticated remote code execution.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "h2: Remote Code Execution in Console",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP) the openshift4/ose-metering-presto container image ships the vulnerable version of h2, but as it uses default configuration the impact by this vulnerability is LOW. Additionally, the Presto component is part of the OCP Metering stack and since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-42392",
            },
            {
               category: "external",
               summary: "RHBZ#2039403",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2039403",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-42392",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-42392",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
            },
            {
               category: "external",
               summary: "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
               url: "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
            },
         ],
         release_date: "2022-01-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "h2: Remote Code Execution in Console",
      },
      {
         cve: "CVE-2021-43797",
         cwe: {
            id: "CWE-444",
            name: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
         },
         discovery_date: "2021-12-09T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2031958",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty: control chars in header names may lead to HTTP request smuggling",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.\nSince the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix.\nThe openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase.\nA fix was introduced in netty-codec-http version 4.1.72.Final.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-43797",
            },
            {
               category: "external",
               summary: "RHBZ#2031958",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2031958",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-43797",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-43797",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
               url: "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
            },
         ],
         release_date: "2021-12-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "netty: control chars in header names may lead to HTTP request smuggling",
      },
      {
         cve: "CVE-2022-0084",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         discovery_date: "2022-03-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2064226",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Although the CVSS stands for 7.5 score, the impact remains Moderate as it demands previous knowledge of the environment to trigger the Denial of Service (DoS)",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0084",
            },
            {
               category: "external",
               summary: "RHBZ#2064226",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064226",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0084",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0084",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0084",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0084",
            },
         ],
         release_date: "2022-03-15T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Johan Nilsson",
               ],
               organization: "NRMC team (Nasdaq)",
            },
         ],
         cve: "CVE-2022-0225",
         cwe: {
            id: "CWE-79",
            name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
         },
         discovery_date: "2022-01-13T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2040268",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: Stored XSS in groups dropdown",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0225",
            },
            {
               category: "external",
               summary: "RHBZ#2040268",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2040268",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0225",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0225",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0225",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0225",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m",
            },
         ],
         release_date: "2022-01-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.7,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: Stored XSS in groups dropdown",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Oliver Bieri",
               ],
               organization: "Schindler Elevator Ltd., Switzerland",
            },
         ],
         cve: "CVE-2022-0866",
         cwe: {
            id: "CWE-1220",
            name: "Insufficient Granularity of Access Control",
         },
         discovery_date: "2022-02-02T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2060929",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Wildfly, where it returns an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "JBoss EAP 7.1 until 7.4 is not affected by default as it comes with Legacy Security enabled out-of-the-box. This only affects application scope range and the methods mentioned, no access to server data.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0866",
            },
            {
               category: "external",
               summary: "RHBZ#2060929",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060929",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0866",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0866",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0866",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0866",
            },
         ],
         release_date: "2022-05-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
            {
               category: "workaround",
               details: "In order to avoid the possibility of information access, review application source code for '@RunAs' and 'run-as-principal' usage. Also, make sure the application is using or not Elytron Security. It's possible to investigate by checking if the commands from '$JBOSS_HOME/docs/examples/enable-elytron.cli' or similar were executed.",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Aytaç Kalıncı",
                  "Ilker Bulgurcu",
                  "Yasin Yılmaz",
               ],
               organization: "NETAŞ PENTEST TEAM",
            },
         ],
         cve: "CVE-2022-2256",
         cwe: {
            id: "CWE-79",
            name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
         },
         discovery_date: "2022-06-27T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2101942",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Stored Cross-site scripting (XSS) vulnerability was found in keycloak. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: improper input validation permits script injection",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-2256",
            },
            {
               category: "external",
               summary: "RHBZ#2101942",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-2256",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-2256",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
            },
         ],
         release_date: "2022-06-28T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.8,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "keycloak: improper input validation permits script injection",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Marek Posolda",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2022-2668",
         cwe: {
            id: "CWE-440",
            name: "Expected Behavior Violation",
         },
         discovery_date: "2022-08-04T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2115392",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in keycloak. The vulnerability allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-2668",
            },
            {
               category: "external",
               summary: "RHBZ#2115392",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2115392",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-2668",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-2668",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-2668",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-2668",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v",
            },
         ],
         release_date: "2022-08-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "New Red Hat Single Sign-On 7.5.3 packages are now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.5.3 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.5.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)\n\n* wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled (CVE-2022-0866)\n\n* xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)\n\n* netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n\n* keycloak-saml-core: keycloak: Uploading of SAML javascript protocol mapper scripts through the admin (CVE-2022-2668)\n\n* keycloak: Stored XSS in groups dropdown (CVE-2022-0225)\n\n* h2: Remote Code Execution in Console (CVE-2021-42392)\n\n* keycloak-core: keycloak: improper input validation permits script injection (CVE-2022-2256)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2022:6783",
            url: "https://access.redhat.com/errata/RHSA-2022:6783",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "2031958",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2031958",
         },
         {
            category: "external",
            summary: "2039403",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2039403",
         },
         {
            category: "external",
            summary: "2040268",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2040268",
         },
         {
            category: "external",
            summary: "2060929",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060929",
         },
         {
            category: "external",
            summary: "2064226",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064226",
         },
         {
            category: "external",
            summary: "2064698",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
         },
         {
            category: "external",
            summary: "2101942",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
         },
         {
            category: "external",
            summary: "2115392",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2115392",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6783.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 8",
      tracking: {
         current_release_date: "2025-04-15T10:58:22+00:00",
         generator: {
            date: "2025-04-15T10:58:22+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2022:6783",
         initial_release_date: "2022-10-04T15:35:14+00:00",
         revision_history: [
            {
               date: "2022-10-04T15:35:14+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2022-10-04T15:35:14+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-15T10:58:22+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Single Sign-On 7.5 for RHEL 8",
                        product: {
                           name: "Red Hat Single Sign-On 7.5 for RHEL 8",
                           product_id: "8Base-RHSSO-7.5",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:red_hat_single_sign_on:7.5::el8",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Single Sign-On",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                        product: {
                           name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                           product_id: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak@15.0.8-1.redhat_00001.1.el8sso?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                        product: {
                           name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_id: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak@15.0.8-1.redhat_00001.1.el8sso?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                        product: {
                           name: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_id: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-sso7-keycloak-server@15.0.8-1.redhat_00001.1.el8sso?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8",
               product_id: "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            },
            product_reference: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            relates_to_product_reference: "8Base-RHSSO-7.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src as a component of Red Hat Single Sign-On 7.5 for RHEL 8",
               product_id: "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
            },
            product_reference: "rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
            relates_to_product_reference: "8Base-RHSSO-7.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch as a component of Red Hat Single Sign-On 7.5 for RHEL 8",
               product_id: "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            },
            product_reference: "rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            relates_to_product_reference: "8Base-RHSSO-7.5",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-36518",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2022-03-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2064698",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: denial of service via a large depth of nested objects",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "CodeReady Studio is no longer supported and therefore this flaw will not be addressed in CodeReady Studio.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "RHBZ#2064698",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
               url: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
               url: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
            },
         ],
         release_date: "2020-08-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: denial of service via a large depth of nested objects",
      },
      {
         cve: "CVE-2021-42392",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-01-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2039403",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited through various attack vectors, most notably through the H2 Console, which leads to unauthenticated remote code execution.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "h2: Remote Code Execution in Console",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP) the openshift4/ose-metering-presto container image ships the vulnerable version of h2, but as it uses default configuration the impact by this vulnerability is LOW. Additionally, the Presto component is part of the OCP Metering stack and since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-42392",
            },
            {
               category: "external",
               summary: "RHBZ#2039403",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2039403",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-42392",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-42392",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
            },
            {
               category: "external",
               summary: "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
               url: "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
            },
         ],
         release_date: "2022-01-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "h2: Remote Code Execution in Console",
      },
      {
         cve: "CVE-2021-43797",
         cwe: {
            id: "CWE-444",
            name: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
         },
         discovery_date: "2021-12-09T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2031958",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty: control chars in header names may lead to HTTP request smuggling",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.\nSince the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix.\nThe openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase.\nA fix was introduced in netty-codec-http version 4.1.72.Final.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-43797",
            },
            {
               category: "external",
               summary: "RHBZ#2031958",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2031958",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-43797",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-43797",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
               url: "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
            },
         ],
         release_date: "2021-12-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "netty: control chars in header names may lead to HTTP request smuggling",
      },
      {
         cve: "CVE-2022-0084",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         discovery_date: "2022-03-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2064226",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Although the CVSS stands for 7.5 score, the impact remains Moderate as it demands previous knowledge of the environment to trigger the Denial of Service (DoS)",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0084",
            },
            {
               category: "external",
               summary: "RHBZ#2064226",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064226",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0084",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0084",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0084",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0084",
            },
         ],
         release_date: "2022-03-15T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Johan Nilsson",
               ],
               organization: "NRMC team (Nasdaq)",
            },
         ],
         cve: "CVE-2022-0225",
         cwe: {
            id: "CWE-79",
            name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
         },
         discovery_date: "2022-01-13T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2040268",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: Stored XSS in groups dropdown",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0225",
            },
            {
               category: "external",
               summary: "RHBZ#2040268",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2040268",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0225",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0225",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0225",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0225",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m",
            },
         ],
         release_date: "2022-01-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.7,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: Stored XSS in groups dropdown",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Oliver Bieri",
               ],
               organization: "Schindler Elevator Ltd., Switzerland",
            },
         ],
         cve: "CVE-2022-0866",
         cwe: {
            id: "CWE-1220",
            name: "Insufficient Granularity of Access Control",
         },
         discovery_date: "2022-02-02T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2060929",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Wildfly, where it returns an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "JBoss EAP 7.1 until 7.4 is not affected by default as it comes with Legacy Security enabled out-of-the-box. This only affects application scope range and the methods mentioned, no access to server data.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0866",
            },
            {
               category: "external",
               summary: "RHBZ#2060929",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060929",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0866",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0866",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0866",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0866",
            },
         ],
         release_date: "2022-05-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
            {
               category: "workaround",
               details: "In order to avoid the possibility of information access, review application source code for '@RunAs' and 'run-as-principal' usage. Also, make sure the application is using or not Elytron Security. It's possible to investigate by checking if the commands from '$JBOSS_HOME/docs/examples/enable-elytron.cli' or similar were executed.",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Aytaç Kalıncı",
                  "Ilker Bulgurcu",
                  "Yasin Yılmaz",
               ],
               organization: "NETAŞ PENTEST TEAM",
            },
         ],
         cve: "CVE-2022-2256",
         cwe: {
            id: "CWE-79",
            name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
         },
         discovery_date: "2022-06-27T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2101942",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Stored Cross-site scripting (XSS) vulnerability was found in keycloak. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: improper input validation permits script injection",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-2256",
            },
            {
               category: "external",
               summary: "RHBZ#2101942",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-2256",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-2256",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
            },
         ],
         release_date: "2022-06-28T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.8,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "keycloak: improper input validation permits script injection",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Marek Posolda",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2022-2668",
         cwe: {
            id: "CWE-440",
            name: "Expected Behavior Violation",
         },
         discovery_date: "2022-08-04T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2115392",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in keycloak. The vulnerability allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
               "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-2668",
            },
            {
               category: "external",
               summary: "RHBZ#2115392",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2115392",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-2668",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-2668",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-2668",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-2668",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v",
            },
         ],
         release_date: "2022-08-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:35:14+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6783",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-0:15.0.8-1.redhat_00001.1.el8sso.src",
                  "8Base-RHSSO-7.5:rh-sso7-keycloak-server-0:15.0.8-1.redhat_00001.1.el8sso.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "A security update is now available for Red Hat Single Sign-On 7.5 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.5.3 serves as a replacement for Red Hat Single Sign-On 7.5.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)\n\n* h2: Remote Code Execution in Console (CVE-2021-42392)\n\n* netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n\n* xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)\n\n* keycloak: Stored XSS in groups dropdown (CVE-2022-0225)\n\n* wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled (CVE-2022-0866)\n\n* keycloak-saml-core: keycloak: Uploading of SAML javascript protocol mapper scripts through the admin (CVE-2022-2668)\n\n* keycloak-core: keycloak: improper input validation permits script injection (CVE-2022-2256)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2022:6787",
            url: "https://access.redhat.com/errata/RHSA-2022:6787",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/products/red-hat-single-sign-on/",
            url: "https://access.redhat.com/products/red-hat-single-sign-on/",
         },
         {
            category: "external",
            summary: "2031958",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2031958",
         },
         {
            category: "external",
            summary: "2039403",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2039403",
         },
         {
            category: "external",
            summary: "2040268",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2040268",
         },
         {
            category: "external",
            summary: "2060929",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060929",
         },
         {
            category: "external",
            summary: "2064226",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064226",
         },
         {
            category: "external",
            summary: "2064698",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
         },
         {
            category: "external",
            summary: "2101942",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
         },
         {
            category: "external",
            summary: "2115392",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2115392",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6787.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update",
      tracking: {
         current_release_date: "2025-04-15T10:58:05+00:00",
         generator: {
            date: "2025-04-15T10:58:05+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2022:6787",
         initial_release_date: "2022-10-04T15:53:11+00:00",
         revision_history: [
            {
               date: "2022-10-04T15:53:11+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2022-10-04T15:53:11+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-15T10:58:05+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Single Sign-On 7.0",
                        product: {
                           name: "Red Hat Single Sign-On 7.0",
                           product_id: "Red Hat Single Sign-On 7.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:red_hat_single_sign_on:7",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Single Sign-On",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-36518",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2022-03-16T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2064698",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: denial of service via a large depth of nested objects",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "CodeReady Studio is no longer supported and therefore this flaw will not be addressed in CodeReady Studio.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "RHBZ#2064698",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064698",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
               url: "https://www.cve.org/CVERecord?id=CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2020-36518",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
               url: "https://github.com/advisories/GHSA-57j2-w4cx-62h2",
            },
         ],
         release_date: "2020-08-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: denial of service via a large depth of nested objects",
      },
      {
         cve: "CVE-2021-42392",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2022-01-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2039403",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited through various attack vectors, most notably through the H2 Console, which leads to unauthenticated remote code execution.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "h2: Remote Code Execution in Console",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP) the openshift4/ose-metering-presto container image ships the vulnerable version of h2, but as it uses default configuration the impact by this vulnerability is LOW. Additionally, the Presto component is part of the OCP Metering stack and since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-42392",
            },
            {
               category: "external",
               summary: "RHBZ#2039403",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2039403",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-42392",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-42392",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
            },
            {
               category: "external",
               summary: "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
               url: "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
            },
         ],
         release_date: "2022-01-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "h2: Remote Code Execution in Console",
      },
      {
         cve: "CVE-2021-43797",
         cwe: {
            id: "CWE-444",
            name: "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
         },
         discovery_date: "2021-12-09T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2031958",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty: control chars in header names may lead to HTTP request smuggling",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.\nSince the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix.\nThe openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase.\nA fix was introduced in netty-codec-http version 4.1.72.Final.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2021-43797",
            },
            {
               category: "external",
               summary: "RHBZ#2031958",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2031958",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2021-43797",
               url: "https://www.cve.org/CVERecord?id=CVE-2021-43797",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
               url: "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
            },
         ],
         release_date: "2021-12-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "netty: control chars in header names may lead to HTTP request smuggling",
      },
      {
         cve: "CVE-2022-0084",
         cwe: {
            id: "CWE-770",
            name: "Allocation of Resources Without Limits or Throttling",
         },
         discovery_date: "2022-03-15T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2064226",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Although the CVSS stands for 7.5 score, the impact remains Moderate as it demands previous knowledge of the environment to trigger the Denial of Service (DoS)",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0084",
            },
            {
               category: "external",
               summary: "RHBZ#2064226",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2064226",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0084",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0084",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0084",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0084",
            },
         ],
         release_date: "2022-03-15T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Johan Nilsson",
               ],
               organization: "NRMC team (Nasdaq)",
            },
         ],
         cve: "CVE-2022-0225",
         cwe: {
            id: "CWE-79",
            name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
         },
         discovery_date: "2022-01-13T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2040268",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: Stored XSS in groups dropdown",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0225",
            },
            {
               category: "external",
               summary: "RHBZ#2040268",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2040268",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0225",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0225",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0225",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0225",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m",
            },
         ],
         release_date: "2022-01-13T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.7,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: Stored XSS in groups dropdown",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Oliver Bieri",
               ],
               organization: "Schindler Elevator Ltd., Switzerland",
            },
         ],
         cve: "CVE-2022-0866",
         cwe: {
            id: "CWE-1220",
            name: "Insufficient Granularity of Access Control",
         },
         discovery_date: "2022-02-02T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2060929",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Wildfly, where it returns an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "JBoss EAP 7.1 until 7.4 is not affected by default as it comes with Legacy Security enabled out-of-the-box. This only affects application scope range and the methods mentioned, no access to server data.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-0866",
            },
            {
               category: "external",
               summary: "RHBZ#2060929",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2060929",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-0866",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-0866",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-0866",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-0866",
            },
         ],
         release_date: "2022-05-03T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
            {
               category: "workaround",
               details: "In order to avoid the possibility of information access, review application source code for '@RunAs' and 'run-as-principal' usage. Also, make sure the application is using or not Elytron Security. It's possible to investigate by checking if the commands from '$JBOSS_HOME/docs/examples/enable-elytron.cli' or similar were executed.",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Aytaç Kalıncı",
                  "Ilker Bulgurcu",
                  "Yasin Yılmaz",
               ],
               organization: "NETAŞ PENTEST TEAM",
            },
         ],
         cve: "CVE-2022-2256",
         cwe: {
            id: "CWE-79",
            name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
         },
         discovery_date: "2022-06-27T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2101942",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Stored Cross-site scripting (XSS) vulnerability was found in keycloak. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: improper input validation permits script injection",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-2256",
            },
            {
               category: "external",
               summary: "RHBZ#2101942",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2101942",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-2256",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-2256",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-2256",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49",
            },
         ],
         release_date: "2022-06-28T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 3.8,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "keycloak: improper input validation permits script injection",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Marek Posolda",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2022-2668",
         cwe: {
            id: "CWE-440",
            name: "Expected Behavior Violation",
         },
         discovery_date: "2022-08-04T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2115392",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in keycloak. The vulnerability allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-2668",
            },
            {
               category: "external",
               summary: "RHBZ#2115392",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2115392",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-2668",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-2668",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-2668",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-2668",
            },
            {
               category: "external",
               summary: "https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v",
               url: "https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v",
            },
         ],
         release_date: "2022-08-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2022-10-04T15:53:11+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2022:6787",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console",
      },
   ],
}