CVE-2017-15112

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.

Score

CVSS 3.0 7.8 High

Status

Modified - secalert@redhat.com

Published

2018-01-20

Last modified

2024-09-16

Weaknesses

CWE-200

Affected products

• Keycloak-httpd-client-install (Jdennis)
• Keycloak-httpd-client-install (Keycloak-httpd-client-install Project)

References

• https://access.redhat.com/errata/RHSA-2019:2137
• https://github.com/jdennis/keycloak-httpd-client-install/commit/c3121b271abaaa1a76de2b9ae89dacde0105cd75