CVE-2017-2585

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
redhatkeycloak
𝑥
< 2.5.1
redhatsingle_sign_on
7.1
redhatsingle_sign_on
7.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2017-0876.html
http://www.securityfocus.com/bid/97393
http://www.securitytracker.com/id/1038180
https://access.redhat.com/errata/RHSA-2017:0872
https://access.redhat.com/errata/RHSA-2017:0873
https://bugzilla.redhat.com/show_bug.cgi?id=1412376
http://rhn.redhat.com/errata/RHSA-2017-0876.html
http://www.securityfocus.com/bid/97393
http://www.securitytracker.com/id/1038180
https://access.redhat.com/errata/RHSA-2017:0872
https://access.redhat.com/errata/RHSA-2017:0873
https://bugzilla.redhat.com/show_bug.cgi?id=1412376