NetSight
IP …
medium5.9

CVE-2017-2585

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially …

Impact

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

Affected products

VendorProductAffected versions
RedhatKeycloak
before 2.5.1
RedhatSingle Sign On
Versions 7.1, 7.2

Weakness classification

CWE-200

References