[RHSA-2022:0015-02] Important: security update of rh-sso-7/sso75 container images

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: security update of rh-sso-7/sso75 container images
Advisory ID:       RHSA-2022:0015-01
Product:           Red Hat OpenShift Enterprise
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0015
Issue date:        2022-01-04
CVE Names:         CVE-2021-3712 CVE-2021-4133 CVE-2021-42574 
=====================================================================

1. Summary:

A security update is now available for Red Hat Single Sign-On 7.5 container
images.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat Single Sign-On 7.5 container images, based on the Keycloak project,
that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This is a security update Red Hat Single Sign-On 7.5, and includes one
security fix.

Security Fix:

* keycloak: Incorrect authorization allows unpriviledged users to create
other users (CVE-2021-4133)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

The RHEL-8 based Middleware Containers container image provided by this
update
can be downloaded from the Red Hat Container Registry at
registry.access.redhat.com. Installation instructions for your platform are
available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image
specifically, or to the latest image generally.

4. Bugs fixed (https://bugzilla.redhat.com/):

2033602 - CVE-2021-4133 Keycloak: Incorrect authorization allows unpriviledged users to create other users

5. References:

https://access.redhat.com/security/cve/CVE-2021-3712
https://access.redhat.com/security/cve/CVE-2021-4133
https://access.redhat.com/security/cve/CVE-2021-42574
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYdSkWdzjgjWX9erEAQjOBw//ZN/oOpkFh/RwaA25IpQ4K3zmPDPQxA8+
E7goOKQQlEnp+5UiYMdPubbPA+liDU1TTzHtE/ik+Tz2jh56osnVSLEBIv7h+Szz
eUoHiR6tqGINgb8/OscUMv52O4+9I3PR8YR4Bh8J/LdPjPVHRQKZWoaF6WRzJTQi
nwZNr76wL/dO8vENpzKv5H3hifoK9ud+dSIfXOakHoHLSys9VnQ0oQhUwVlo2xUy
ZRRmVuq3cFhADw1eSASowIGDZjLHI2SkWwtxw8MCvRXJj2/UDcZ4236IPJHlMqgi
pkRBRfv2s0x0qWZ5J5F9H0R+BMHPRICRlmPbpnpNotZrNkGUgburpZJEHIcVWTrj
DC8ZaKHLqh+SEtbsYizxn/zo2SAi0qAjAWdogvRBz7poXeVlx7qoK0nrV67R5nCv
8vbpj3XdjlhkNlY8CG99lwssoxmJdNMlxW2A8BJn+EpVv0liLhqGCwuFF7HwnAgF
2FOKiiZ8xd+2DAnAeo67qoKz2O51umxhfcy45ec8AyipHeHOjoHeEro92Q4amY5T
Z7bzm90etCW2ZkDdYxEdle0jYq0dfd3EP9e6g6yXnLYHrXJGLHuk18vNvaab6ggG
didBcrveqsRldXwImF6ZZgO8Bu05rMrOiJup6gqF8ymNJdn16LyErwkYLQhD23a1
sicdnNZBSkk=
=BGO4
-----END PGP SIGNATURE-----