PT-2021-9719 · Red Hat · Red Hat Single Sign-On

Dave Baker · Published 2021-01-12 · Updated 2021-01-19 · CVE-2020-14341

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Single Sign On versions 7.x

Description The issue allows an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of their choosing, originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may gather information about hosts and ports they do not have access to scan directly.

Recommendations For Red Hat Single Sign On version 7.x, consider restricting access to the "Test Connection" feature in the application console to minimize the risk of exploitation. As a temporary workaround, disabling the "Test Connection" functionality may help until a more permanent solution is available.

Fix

Weakness Enumeration

CWE-385

Related Identifiers

CVE-2020-14341

Affected Products

Red Hat Single Sign-On

References · 6

• https://osv.dev/vulnerability/CVE-2020-14341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14341 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1860138 · Vendor Advisory
• https://t.me/cvenotify/8440 · Telegram Post
• https://t.me/cvenotify/8675 · Telegram Post
• https://t.me/cibsecurity/21949 · Telegram Post