Description

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2017-0876.html

http://www.securityfocus.com/bid/97393

http://www.securitytracker.com/id/1038180

https://access.redhat.com/errata/RHSA-2017:0872

https://access.redhat.com/errata/RHSA-2017:0873

https://bugzilla.redhat.com/show_bug.cgi?id=1412376

Related Vulnerabilities

CVE-2023-36479 Vulnerability in maven package org.eclipse.jetty.ee10:jetty-ee10-servlets

CVE-2022-36902 Vulnerability in maven package com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter

CVE-2020-28052 Vulnerability in maven package org.bouncycastle:bcprov-jdk15on

CVE-2020-2316 Vulnerability in maven package org.jvnet.hudson.plugins:analysis-core

CVE-2014-7827 Vulnerability in maven package org.picketlink:picketlink-federation

Severity

Medium

Classification

CWE-200 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Third Party Advisory VDB Entry Issue Tracking