Описание
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
It was found that keycloak's implementation of HMAC verification for JWS tokens uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Mobile Application Platform 4 | keycloak | Will not fix | ||
| Red Hat Single Sign-On 7.1 | Fixed | RHSA-2017:0876 | 04.04.2017 | |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7 | Fixed | RHSA-2017:0872 | 04.04.2017 |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7-freemarker | Fixed | RHSA-2017:0872 | 04.04.2017 |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7-javapackages-tools | Fixed | RHSA-2017:0872 | 04.04.2017 |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7-keycloak | Fixed | RHSA-2017:0872 | 04.04.2017 |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7-libunix-dbus-java | Fixed | RHSA-2017:0872 | 04.04.2017 |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7-liquibase | Fixed | RHSA-2017:0872 | 04.04.2017 |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7-twitter4j | Fixed | RHSA-2017:0872 | 04.04.2017 |
| Red Hat Single Sign-On 7.1 for RHEL 6 | rh-sso7-zxing | Fixed | RHSA-2017:0872 | 04.04.2017 |
Показывать по
Дополнительная информация
Статус:
3.7 Low
CVSS3
2.6 Low
CVSS2
Связанные уязвимости
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC ve ...
keycloak-core vulnerable to timing attacks against JWS token verification
3.7 Low
CVSS3
2.6 Low
CVSS2