{"containers": {"cna": {"affected": [{"product": "keycloak", "vendor": "Red Hat, Inc.", "versions": [{"status": "affected", "version": "2.5.1"}]}], "datePublic": "2017-04-04T00:00:00", "descriptions": [{"lang": "en", "value": "Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks."}], "problemTypes": [{"descriptions": [{"description": "None", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-03-13T09:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "RHSA-2017:0876", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0876.html"}, {"name": "1038180", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038180"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412376"}, {"name": "97393", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/97393"}, {"name": "RHSA-2017:0873", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:0873"}, {"name": "RHSA-2017:0872", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:0872"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "DATE_PUBLIC": "2017-04-04T00:00:00", "ID": "CVE-2017-2585", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "keycloak", "version": {"version_data": [{"version_value": "2.5.1"}]}}]}, "vendor_name": "Red Hat, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "None"}]}]}, "references": {"reference_data": [{"name": "RHSA-2017:0876", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0876.html"}, {"name": "1038180", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038180"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1412376", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412376"}, {"name": "97393", "refsource": "BID", "url": "http://www.securityfocus.com/bid/97393"}, {"name": "RHSA-2017:0873", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:0873"}, {"name": "RHSA-2017:0872", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:0872"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T13:55:06.129Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2017:0876", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0876.html"}, {"name": "1038180", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038180"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412376"}, {"name": "97393", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/97393"}, {"name": "RHSA-2017:0873", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:0873"}, {"name": "RHSA-2017:0872", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:0872"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2017-2585", "datePublished": "2018-03-12T15:00:00Z", "dateReserved": "2016-12-01T00:00:00", "dateUpdated": "2024-09-16T22:56:17.924Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2C6178C-0196-42C2-9947-777F4F397D9D", "versionEndExcluding": "2.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign_on:7.1:*:*:*:*:*:*:*", "matchCriteriaId": "11FE6021-DBE7-4FFD-B021-F97EF80BDEEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:single_sign_on:7.2:*:*:*:*:*:*:*", "matchCriteriaId": "0AB839F9-8CE2-4EAE-90F2-2CA55742957E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0", "vulnerable": false}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks."}, {"lang": "es", "value": "Red Hat Keycloak, en versiones anteriores a la 2.5.1, tiene una implementaci\u00f3n de la verificaci\u00f3n HMAC para los tokens JWS que emplea un m\u00e9todo que se ejecuta en tiempo no constante, lo que podr\u00eda hacer que la aplicaci\u00f3n sea vulnerable a ataques de sincronizaci\u00f3n."}], "id": "CVE-2017-2585", "lastModified": "2018-04-12T15:14:13.500", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-03-12T15:29:00.397", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0876.html"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/97393"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038180"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:0872"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:0873"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412376"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Richard Kettelerij (Mindloops) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2017:0876", "cpe": "cpe:/a:redhat:jboss_single_sign_on:7.1", "product_name": "Red Hat Single Sign-On 7.1", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-0:1-2.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-freemarker-0:2.3.23-1.redhat_2.2.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-javapackages-tools-0:3.4.1-5.15.3.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-keycloak-0:2.5.5-2.Final_redhat_1.1.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-libunix-dbus-java-0:0.8.0-2.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-liquibase-0:3.4.1-2.redhat_2.1.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-twitter4j-0:4.0.4-1.redhat_3.1.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0872", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el6", "package": "rh-sso7-zxing-0:3.2.1-1.redhat_4.1.jbcs.el6", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 6", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-0:1-2.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-freemarker-0:2.3.23-1.redhat_2.2.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-javapackages-tools-0:3.4.1-5.15.3.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-keycloak-0:2.5.5-2.Final_redhat_1.1.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-libunix-dbus-java-0:0.8.0-2.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-liquibase-0:3.4.1-2.redhat_2.1.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-twitter4j-0:4.0.4-1.redhat_3.1.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}, {"advisory": "RHSA-2017:0873", "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7::el7", "package": "rh-sso7-zxing-0:3.2.1-1.redhat_4.1.jbcs.el7", "product_name": "Red Hat Single Sign-On 7.1 for RHEL 7", "release_date": "2017-04-04T00:00:00Z"}], "bugzilla": {"description": "keycloak: timing attack in JWS signature verification", "id": "1412376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412376"}, "csaw": false, "cvss": {"cvss_base_score": "2.6", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "status": "verified"}, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-385", "details": ["Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.", "It was found that keycloak's implementation of HMAC verification for JWS tokens uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks."], "name": "CVE-2017-2585", "package_state": [{"cpe": "cpe:/a:redhat:mobile_application_platform:4", "fix_state": "Will not fix", "impact": "moderate", "package_name": "keycloak", "product_name": "Red Hat Mobile Application Platform 4"}], "public_date": "2017-04-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-2585\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-2585"], "threat_severity": "Moderate", "upstream_fix": "keycloak 2.5.1"}