TI-2017-08950 CVE-2017-12159 · GHSA-7fmw-85qm-h22p
Insufficient session expiration in Red Hat keycloak
Priority LOW 38
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.
RHSA-2017:2905
rh-sso7-keycloak security update
Released 2017-10-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Single Sign-On 7.1 for RHEL 7 Server rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7, rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el7
Fixes 5 records
TI-2014-08136 CVE-2014-9970 · GHSA-r5c2-rxh2-f5h2
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
Priority LOW 37
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
TI-2017-08951 CVE-2017-12160 · GHSA-qc72-gfvw-76h7
Improper authorization in Red Hat keycloak
Priority LOW 35
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation.
TI-2017-08987 CVE-2017-12197 · GHSA-x9rg-q5fx-fx66
Incorrect authorization in Red Hat libpam4j
Priority LOW 32
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating.
TI-2017-08949 CVE-2017-12158 · GHSA-v38p-mqq3-m6v5
Cross-site scripting in Red Hat keycloak
Priority LOW 26
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.