CVE-2017-2585

Published: Mar 12, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

Affected (3)

Products: Redhat: Keycloak, Single Sign On

Redhat

2 products

Keycloak

Single Sign On

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Keycloak	Before 2.5.1

Configuration B

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Single Sign On	Version 7.1
Redhat Single Sign On	Version 7.2

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

http://rhn.redhat.com/errata/RHSA-2017-0876.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/97393

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038180

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:0872

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:0873

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1412376

Source: secalert@redhat.com

Issue Tracking

http://rhn.redhat.com/errata/RHSA-2017-0876.html