title: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update
description: keycloak: verify-token-audience support is missing in the NodeJS adapter keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution jackson-databind: Lacks certain xbean-reflect/JNDI blocking jackson-databind: Serialization gadgets in shaded-hikari-config jackson-databind: Serialization gadgets in ibatis-sqlmap jackson-databind: Serialization gadgets in anteros-core undertow: invalid HTTP request with large chunk size keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) jackson-databind: Serialization gadgets in javax.swing.JEditorPane jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
cpes: cpe:/a:redhat:jboss_single_sign_on:7.4