A rh-sso-7/sso75-openshift-rhel8 container image has been released.

RHSA-2022:1713-01: Moderate: security update for rh-sso-7/sso75-openshift-rhel8 container image

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: security update for rh-sso-7/sso75-openshift-rhel8 container image
Advisory ID: RHSA-2022:1713-01
Product: Red Hat OpenShift Enterprise
Advisory URL:   https://access.redhat.com/errata/RHSA-2022:1713
Issue date: 2022-05-04
CVE Names: CVE-2018-25032 CVE-2022-1154 CVE-2022-1245
CVE-2022-1271 CVE-2022-21426 CVE-2022-21434
CVE-2022-21443 CVE-2022-21476 CVE-2022-21496
=====================================================================

1. Summary:

Security updated rh-sso-7/sso75-openshift-rhel8 container image is now
available for RHEL-8 based Middleware Containers.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

The rh-sso-7/sso75-openshift-rhel8 container image has been updated for
RHEL-8 based Middleware Containers to include the following security
issues.

Security Fix(es):

* keycloak: Privilege escalation vulnerability on Token Exchange
(CVE-2022-1245)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Users of rh-sso-7/sso75-openshift-rhel8 container images are advised to
upgrade to these updated images, which contain backported patches to
correct these security issues, fix these bugs and add these enhancements.
Users of these images are also encouraged to rebuild all container images
that depend on these images.

You can find images updated by this advisory in Red Hat Container Catalog
(see References).

3. Solution:

The RHEL-8 based Middleware Containers container image provided by this
update can be downloaded from the Red Hat Container Registry at
registry.access.redhat.com. Installation instructions for your platform are
available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image
specifically, or to the latest image generally.

4. Bugs fixed (  https://bugzilla.redhat.com/):

2071036 - CVE-2022-1245 keycloak: Privilege escalation vulnerability on Token Exchange

5. References:

  https://access.redhat.com/security/cve/CVE-2018-25032
  https://access.redhat.com/security/cve/CVE-2022-1154
  https://access.redhat.com/security/cve/CVE-2022-1245
  https://access.redhat.com/security/cve/CVE-2022-1271
  https://access.redhat.com/security/cve/CVE-2022-21426
  https://access.redhat.com/security/cve/CVE-2022-21434
  https://access.redhat.com/security/cve/CVE-2022-21443
  https://access.redhat.com/security/cve/CVE-2022-21476
  https://access.redhat.com/security/cve/CVE-2022-21496
  https://access.redhat.com/security/updates/classification/#moderate
  https://access.redhat.com/security/cve/cve-2022-1245
  https://access.redhat.com/containers/?tab=images#/registry.access.redhat.com/rh-sso-7/sso75-openshift-rhel8
  https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html/release_notes/index

6. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.