Single Sign On (Redhat) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2018-03-12. Vendor: Redhat.

CVEs of Single Sign On

• CVE-2017-2585 - CVSS 5.9 (medium), 2018-03-12: Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially…
• CVE-2016-8629 - CVSS 6.5 (medium), 2018-03-12: Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An…
• CVE-2017-12159 - CVSS 7.5 (high), 2017-10-26: It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an…
• CVE-2017-12158 - CVSS 5.4 (medium), 2017-10-26: It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw…