Red Hat Linux 7.0

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

Published: 2019-04-23T15:57:07.000Z
Updated: 2024-08-04T17:44:15.919Z

A remote unauthorized disclosure of information vulnerability was identified in HPE Service Governance Framework (SGF) version 4.2, 4.3. A race condition under high load in SGF exists where SGF transferred different parameter to the enabler.

Published: 2018-10-17T13:00:00.000Z
Updated: 2024-09-16T17:33:04.715Z

A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer. An attacker could use this flaw to cause denial of service via high CPU caused by an infinite loop.

Published: 2018-02-15T17:00:00.000Z
Updated: 2024-08-05T03:44:11.948Z

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

Published: 2018-11-13T19:00:00.000Z
Updated: 2024-08-05T09:38:13.017Z

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

Published: 2018-11-13T19:00:00.000Z
Updated: 2024-08-05T09:38:13.384Z