Red Hat Security Advisory

RHSA-2019:2137

keycloak-httpd-client-install security, bug fix, and enhancement update

Released 2019-08-06 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server (v. 7) keycloak-httpd-client-install-0.8-1.el7, python2-keycloak-httpd-client-install-0.8-1.el7
Red Hat Enterprise Linux Workstation (v. 7) keycloak-httpd-client-install-0.8-1.el7, python2-keycloak-httpd-client-install-0.8-1.el7

Fixes 2 records

TI-2017-11084 CVE-2017-15112 · GHSA-89c9-3758-737w

Information disclosure in jdennis keycloak-httpd-client-install

LOW 34

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00378 Published 2018-01-20 Partial fix · 0.8 CWE-200

TI-2017-11083 CVE-2017-15111 · GHSA-vqf9-v3hc-wr54

Link following in jdennis keycloak-httpd-client-install

LOW 25

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0039 Published 2018-01-20 Partial fix · 0.8 CWE-377