keycloak-core vulnerable to timing attacks against JWS token verification

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2017-2585 · ADVISORY
• access.redhat.com/errata/RHSA-2017:0872 · WEB
• access.redhat.com/errata/RHSA-2017:0873 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• GitHub Advisory GHSA-w6gv-3r3v-gwgj · ADVISORY
• web.archive.org/web/20170420113802/http://www.securitytracker.com/id/1038180 · WEB
• web.archive.org/web/20200227175650/http://www.securityfocus.com/bid/97393 · WEB
• rhn.redhat.com/errata/RHSA-2017-0876.html · WEB
• securityfocus.com/bid/97393 · Third Party Advisory
• securitytracker.com/id/1038180 · Third Party Advisory

org.keycloak:keycloak-core のその他の脆弱性

• CVE-2024-4028低 3.8A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creatin…
• CVE-2024-10039高 7.1Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
• CVE-2023-6841高 7.5A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repe…
• CVE-2024-7318中 4.8A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds …
• CVE-2024-7260中 6.1An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri paramet…