En resumen
- CVE-2017-2585 es una vulnerabilidad MEDIO (CVSS 5.9) que afecta a org.keycloak:keycloak-core, keycloak (redhat), single sign on (redhat).
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.0%, mayor que el 80.5% de las vulnerabilidades.
- Solución: actualizar a 2.5.1 o posterior.
Description
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
NVD description
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
Más vulnerabilidades de org.keycloak:keycloak-core
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free