{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "This release of Red Hat JBoss Enterprise Application Platform 7.2.4 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.3, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.4 Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)\n\n* jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution (CVE-2019-12384)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message (CVE-2019-12814)\n\n* undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files (CVE-2019-10212)\n\n* codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities (CVE-2019-10202)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server (CVE-2019-12086)\n\n* undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2019:2938",
            url: "https://access.redhat.com/errata/RHSA-2019:2938",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.2",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.2",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/",
            url: "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/",
            url: "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/",
         },
         {
            category: "external",
            summary: "1713068",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
         },
         {
            category: "external",
            summary: "1713468",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
         },
         {
            category: "external",
            summary: "1725795",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
         },
         {
            category: "external",
            summary: "1725807",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725807",
         },
         {
            category: "external",
            summary: "1731271",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1731271",
         },
         {
            category: "external",
            summary: "1731984",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1731984",
         },
         {
            category: "external",
            summary: "1737517",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
         },
         {
            category: "external",
            summary: "JBEAP-16455",
            url: "https://issues.redhat.com/browse/JBEAP-16455",
         },
         {
            category: "external",
            summary: "JBEAP-16779",
            url: "https://issues.redhat.com/browse/JBEAP-16779",
         },
         {
            category: "external",
            summary: "JBEAP-17045",
            url: "https://issues.redhat.com/browse/JBEAP-17045",
         },
         {
            category: "external",
            summary: "JBEAP-17062",
            url: "https://issues.redhat.com/browse/JBEAP-17062",
         },
         {
            category: "external",
            summary: "JBEAP-17073",
            url: "https://issues.redhat.com/browse/JBEAP-17073",
         },
         {
            category: "external",
            summary: "JBEAP-17109",
            url: "https://issues.redhat.com/browse/JBEAP-17109",
         },
         {
            category: "external",
            summary: "JBEAP-17112",
            url: "https://issues.redhat.com/browse/JBEAP-17112",
         },
         {
            category: "external",
            summary: "JBEAP-17162",
            url: "https://issues.redhat.com/browse/JBEAP-17162",
         },
         {
            category: "external",
            summary: "JBEAP-17178",
            url: "https://issues.redhat.com/browse/JBEAP-17178",
         },
         {
            category: "external",
            summary: "JBEAP-17182",
            url: "https://issues.redhat.com/browse/JBEAP-17182",
         },
         {
            category: "external",
            summary: "JBEAP-17183",
            url: "https://issues.redhat.com/browse/JBEAP-17183",
         },
         {
            category: "external",
            summary: "JBEAP-17223",
            url: "https://issues.redhat.com/browse/JBEAP-17223",
         },
         {
            category: "external",
            summary: "JBEAP-17238",
            url: "https://issues.redhat.com/browse/JBEAP-17238",
         },
         {
            category: "external",
            summary: "JBEAP-17250",
            url: "https://issues.redhat.com/browse/JBEAP-17250",
         },
         {
            category: "external",
            summary: "JBEAP-17271",
            url: "https://issues.redhat.com/browse/JBEAP-17271",
         },
         {
            category: "external",
            summary: "JBEAP-17273",
            url: "https://issues.redhat.com/browse/JBEAP-17273",
         },
         {
            category: "external",
            summary: "JBEAP-17274",
            url: "https://issues.redhat.com/browse/JBEAP-17274",
         },
         {
            category: "external",
            summary: "JBEAP-17276",
            url: "https://issues.redhat.com/browse/JBEAP-17276",
         },
         {
            category: "external",
            summary: "JBEAP-17277",
            url: "https://issues.redhat.com/browse/JBEAP-17277",
         },
         {
            category: "external",
            summary: "JBEAP-17278",
            url: "https://issues.redhat.com/browse/JBEAP-17278",
         },
         {
            category: "external",
            summary: "JBEAP-17294",
            url: "https://issues.redhat.com/browse/JBEAP-17294",
         },
         {
            category: "external",
            summary: "JBEAP-17311",
            url: "https://issues.redhat.com/browse/JBEAP-17311",
         },
         {
            category: "external",
            summary: "JBEAP-17320",
            url: "https://issues.redhat.com/browse/JBEAP-17320",
         },
         {
            category: "external",
            summary: "JBEAP-17321",
            url: "https://issues.redhat.com/browse/JBEAP-17321",
         },
         {
            category: "external",
            summary: "JBEAP-17334",
            url: "https://issues.redhat.com/browse/JBEAP-17334",
         },
         {
            category: "external",
            summary: "JBEAP-17527",
            url: "https://issues.redhat.com/browse/JBEAP-17527",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2938.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 security update",
      tracking: {
         current_release_date: "2025-04-09T17:25:57+00:00",
         generator: {
            date: "2025-04-09T17:25:57+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2019:2938",
         initial_release_date: "2019-09-30T22:57:56+00:00",
         revision_history: [
            {
               date: "2019-09-30T22:57:56+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-09-30T22:57:56+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-09T17:25:57+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss EAP 7.2",
                        product: {
                           name: "Red Hat JBoss EAP 7.2",
                           product_id: "Red Hat JBoss EAP 7.2",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_enterprise_application_platform:7.2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Enterprise Application Platform",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Christian Schlüter",
               ],
               organization: "Viada",
            },
         ],
         cve: "CVE-2019-10184",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2019-03-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713068",
            },
         ],
         notes: [
            {
               category: "description",
               text: "undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "undertow: Information leak in requests for directories without trailing slashes",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10184",
            },
            {
               category: "external",
               summary: "RHBZ#1713068",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
            },
         ],
         release_date: "2019-07-24T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "undertow: Information leak in requests for directories without trailing slashes",
      },
      {
         cve: "CVE-2019-10202",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2019-06-19T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1731271",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10202",
            },
            {
               category: "external",
               summary: "RHBZ#1731271",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1731271",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10202",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10202",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10202",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10202",
            },
         ],
         release_date: "2019-09-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities",
      },
      {
         cve: "CVE-2019-10212",
         cwe: {
            id: "CWE-532",
            name: "Insertion of Sensitive Information into Log File",
         },
         discovery_date: "2019-07-22T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1731984",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "All the Red Hat products using the undertow-core jar version 2.0.20 or before are affected.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10212",
            },
            {
               category: "external",
               summary: "RHBZ#1731984",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1731984",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10212",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10212",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10212",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10212",
            },
         ],
         release_date: "2019-09-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
            {
               category: "workaround",
               details: "Use Elytron instead of legacy Security subsystem.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files",
      },
      {
         cve: "CVE-2019-12086",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-05-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713468",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12086",
            },
            {
               category: "external",
               summary: "RHBZ#1713468",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
            },
         ],
         release_date: "2019-05-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
      },
      {
         cve: "CVE-2019-12384",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2019-06-25T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1725807",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. Depending on the classpath content, remote code execution may be possible.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat OpenStack's OpenDaylight does not use logback in any supported configuration. Therefore, the prerequisites for this vulnerability are not present and OpenDaylight is not affected.\n\nThis vulnerability relies on logback-core (ch.qos.logback.core) being present in the application's ClassPath. Logback-core is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use logback-core are not impacted by this vulnerability.\n\nThis issue affects the versions of jackson-databind bundled with candlepin as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12384",
            },
            {
               category: "external",
               summary: "RHBZ#1725807",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725807",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12384",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12384",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12384",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12384",
            },
         ],
         release_date: "2019-06-21T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution",
      },
      {
         cve: "CVE-2019-12814",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-06-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1725795",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "* Red Hat Satellite 6 does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. \n* Red Hat OpenStack's OpenDaylight does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12814",
            },
            {
               category: "external",
               summary: "RHBZ#1725795",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
            },
         ],
         release_date: "2019-06-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
            {
               category: "workaround",
               details: "This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application's ClassPath.  Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
      },
      {
         cve: "CVE-2019-14379",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2019-07-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1737517",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: default typing mishandling leading to remote code execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nSimilarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14379",
            },
            {
               category: "external",
               summary: "RHBZ#1737517",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
            },
         ],
         release_date: "2019-07-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "jackson-databind: default typing mishandling leading to remote code execution",
      },
      {
         cve: "CVE-2019-19343",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2019-12-06T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1780445",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1 are believed to be vulnerable.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss EAP 7.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-19343",
            },
            {
               category: "external",
               summary: "RHBZ#1780445",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1780445",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-19343",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-19343",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-19343",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-19343",
            },
         ],
         release_date: "2019-12-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-09-30T22:57:56+00:00",
               details: "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe References section of this erratum contains a download link (you must log in to download the update).\n\nThe JBoss server process must be restarted for the update to take effect.",
               product_ids: [
                  "Red Hat JBoss EAP 7.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:2938",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "Red Hat JBoss EAP 7.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.3.4 serves as a replacement for Red Hat Single Sign-On 7.2.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\n* keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message (CVE-2019-12814)\n\n* jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server (CVE-2019-12086)\n\n* undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2019:3050",
            url: "https://access.redhat.com/errata/RHSA-2019:3050",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.3",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.3",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/",
            url: "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/",
         },
         {
            category: "external",
            summary: "1649870",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1649870",
         },
         {
            category: "external",
            summary: "1713068",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
         },
         {
            category: "external",
            summary: "1713468",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
         },
         {
            category: "external",
            summary: "1725795",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
         },
         {
            category: "external",
            summary: "1737517",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
         },
         {
            category: "external",
            summary: "1749487",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
         },
         {
            category: "external",
            summary: "KEYCLOAK-11367",
            url: "https://issues.redhat.com/browse/KEYCLOAK-11367",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3050.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update",
      tracking: {
         current_release_date: "2025-04-09T17:26:38+00:00",
         generator: {
            date: "2025-04-09T17:26:38+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2019:3050",
         initial_release_date: "2019-10-14T18:59:06+00:00",
         revision_history: [
            {
               date: "2019-10-14T18:59:06+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-10-14T18:59:06+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-09T17:26:38+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Single Sign-On 7.3.4 zip",
                        product: {
                           name: "Red Hat Single Sign-On 7.3.4 zip",
                           product_id: "Red Hat Single Sign-On 7.3.4 zip",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_single_sign_on:7.3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Single Sign-On",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Bart Toersche",
               ],
               organization: "Simacan",
            },
         ],
         cve: "CVE-2019-10169",
         cwe: {
            id: "CWE-267",
            name: "Privilege Defined With Unsafe Actions",
         },
         discovery_date: "2019-05-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1721302",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: script execution via UMA policy trigger",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10169",
            },
            {
               category: "external",
               summary: "RHBZ#1721302",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1721302",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10169",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10169",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10169",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10169",
            },
         ],
         release_date: "2020-04-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: script execution via UMA policy trigger",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Bart Toersche",
               ],
               organization: "Simacan",
            },
         ],
         cve: "CVE-2019-10170",
         cwe: {
            id: "CWE-267",
            name: "Privilege Defined With Unsafe Actions",
         },
         discovery_date: "2019-05-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1721295",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: script execution via realm management policy trigger",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10170",
            },
            {
               category: "external",
               summary: "RHBZ#1721295",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1721295",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10170",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10170",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10170",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10170",
            },
         ],
         release_date: "2020-04-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: script execution via realm management policy trigger",
      },
      {
         acknowledgments: [
            {
               names: [
                  "Christian Schlüter",
               ],
               organization: "Viada",
            },
         ],
         cve: "CVE-2019-10184",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2019-03-01T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713068",
            },
         ],
         notes: [
            {
               category: "description",
               text: "undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "undertow: Information leak in requests for directories without trailing slashes",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10184",
            },
            {
               category: "external",
               summary: "RHBZ#1713068",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713068",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10184",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
            },
         ],
         release_date: "2019-07-24T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "undertow: Information leak in requests for directories without trailing slashes",
      },
      {
         cve: "CVE-2019-10212",
         cwe: {
            id: "CWE-532",
            name: "Insertion of Sensitive Information into Log File",
         },
         discovery_date: "2019-07-22T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1731984",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "All the Red Hat products using the undertow-core jar version 2.0.20 or before are affected.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-10212",
            },
            {
               category: "external",
               summary: "RHBZ#1731984",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1731984",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-10212",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-10212",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10212",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10212",
            },
         ],
         release_date: "2019-09-30T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "Use Elytron instead of legacy Security subsystem.",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files",
      },
      {
         cve: "CVE-2019-12086",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-05-18T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1713468",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12086",
            },
            {
               category: "external",
               summary: "RHBZ#1713468",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713468",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12086",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
            },
         ],
         release_date: "2019-05-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
      },
      {
         cve: "CVE-2019-12814",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2019-06-20T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1725795",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "* Red Hat Satellite 6 does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. \n* Red Hat OpenStack's OpenDaylight does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-12814",
            },
            {
               category: "external",
               summary: "RHBZ#1725795",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1725795",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-12814",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
            },
         ],
         release_date: "2019-06-04T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application's ClassPath.  Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability.",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
      },
      {
         cve: "CVE-2019-14379",
         cwe: {
            id: "CWE-502",
            name: "Deserialization of Untrusted Data",
         },
         discovery_date: "2019-07-29T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1737517",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jackson-databind: default typing mishandling leading to remote code execution",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "While OpenShift Container Platform's elasticsearch plugins do ship the vulnerable component, it doesn't do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nSimilarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14379",
            },
            {
               category: "external",
               summary: "RHBZ#1737517",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1737517",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14379",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
            },
         ],
         release_date: "2019-07-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
            {
               category: "workaround",
               details: "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "jackson-databind: default typing mishandling leading to remote code execution",
      },
      {
         cve: "CVE-2019-14820",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2018-11-14T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1649870",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: adapter endpoints are exposed via arbitrary URLs",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14820",
            },
            {
               category: "external",
               summary: "RHBZ#1649870",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1649870",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14820",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14820",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14820",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14820",
            },
         ],
         release_date: "2019-10-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "keycloak: adapter endpoints are exposed via arbitrary URLs",
      },
      {
         cve: "CVE-2019-14832",
         cwe: {
            id: "CWE-863",
            name: "Incorrect Authorization",
         },
         discovery_date: "2019-07-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1749487",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak: cross-realm user access auth bypass",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Single Sign-On 7.3.4 zip",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2019-14832",
            },
            {
               category: "external",
               summary: "RHBZ#1749487",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
               url: "https://www.cve.org/CVERecord?id=CVE-2019-14832",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
            },
         ],
         release_date: "2019-10-14T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2019-10-14T18:59:06+00:00",
               details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
               product_ids: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2019:3050",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "Red Hat Single Sign-On 7.3.4 zip",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak: cross-realm user access auth bypass",
      },
   ],
}