Description

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2017-0876.html

http://www.securityfocus.com/bid/97393

http://www.securitytracker.com/id/1038180

https://access.redhat.com/errata/RHSA-2017:0872

https://access.redhat.com/errata/RHSA-2017:0873

https://bugzilla.redhat.com/show_bug.cgi?id=1412376

Related Vulnerabilities

CVE-2023-24977 Vulnerability in maven package org.apache.inlong:manager-pojo

CVE-2023-37478 Vulnerability in npm package pnpm

CVE-2018-1999002 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2020-14446 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.identity.entitlement.ui

CVE-2022-36313 Vulnerability in maven package org.webjars.npm:file-type

Severity

Medium

Classification

CWE-200 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Third Party Advisory VDB Entry Issue Tracking