CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2017-2582 – keycloak: SAML request parser replaces special strings with system properties
https://notcve.org/view.php?id=CVE-2017-2582
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response. Se ha descubierto que cuando se analizan los mensajes SAML, la clase StaxParserUtil de keycloak en versiones anteriores a la 2.5.1 reemplaza cadenas especiales para obtener valores de atributos con la propiedad del sistema. Esto podría permitir que un atacante determine valores de las propiedades del sistema en el sistema atacado formateando el campo ID de petición SAML para que sea la propiedad del sistema elegida, la cual se puede obtener en el campo "InResponseTO" en la respuesta. It was found that while parsing the SAML messages the StaxParserUtil class of Picketlink replaces special strings for obtaining attribute values with system property. • http://www.securityfocus.com/bid/101046 http://www.securitytracker.com/id/1041707 https://access.redhat.com/errata/RHSA-2017:2808 https://access.redhat.com/errata/RHSA-2017:2809 https://access.redhat.com/errata/RHSA-2017:2810 https://access.redhat.com/errata/RHSA-2017:2811 https://access.redhat.com/errata/RHSA-2017:3216 https://access.redhat.com/errata/RHSA-2017:3217 https://access.redhat.com/errata/RHSA-2017:3218 https://access.redhat.com/errata/RHSA-2017:3219 https: • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2017-2585 – keycloak: timing attack in JWS signature verification
https://notcve.org/view.php?id=CVE-2017-2585
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. Red Hat Keycloak, en versiones anteriores a la 2.5.1, tiene una implementación de la verificación HMAC para los tokens JWS que emplea un método que se ejecuta en tiempo no constante, lo que podría hacer que la aplicación sea vulnerable a ataques de sincronización. It was found that keycloak's implementation of HMAC verification for JWS tokens uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. • http://rhn.redhat.com/errata/RHSA-2017-0876.html http://www.securityfocus.com/bid/97393 http://www.securitytracker.com/id/1038180 https://access.redhat.com/errata/RHSA-2017:0872 https://access.redhat.com/errata/RHSA-2017:0873 https://bugzilla.redhat.com/show_bug.cgi?id=1412376 https://access.redhat.com/security/cve/CVE-2017-2585 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-385: Covert Timing Channel •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2016-8629 – keycloak: user deletion via incorrect permissions check
https://notcve.org/view.php?id=CVE-2016-8629
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm. Red Hat Keycloak, en versiones anteriores a la 2.4.0, no comprobaba correctamente los permisos al gestionar peticiones de eliminación de usuario de cuenta de servicio enviadas al servidor REST. Un atacante con autenticación de cuenta de servicio podría aprovechar este fallo para omitir permisos normales y eliminar usuarios en un realm separado. It was found that keycloak did not correctly check permissions when handling service account user deletion requests sent to the rest server. • http://rhn.redhat.com/errata/RHSA-2017-0876.html http://www.securityfocus.com/bid/97392 http://www.securitytracker.com/id/1038180 https://access.redhat.com/errata/RHSA-2017:0872 https://access.redhat.com/errata/RHSA-2017:0873 https://bugzilla.redhat.com/show_bug.cgi?id=1388988 https://access.redhat.com/security/cve/CVE-2016-8629 • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-8609 – keycloak: account hijacking via auth code fixation
https://notcve.org/view.php?id=CVE-2016-8609
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks. Se ha detectado que keycloak en versiones anteriores a la 2.3.0 no implementó correctamente el flujo de autenticación. Un atacante podría emplear este error para construir una URL de phishing, desde la que podría secuestrar la sesión del usuario. • http://rhn.redhat.com/errata/RHSA-2016-2945.html http://www.securityfocus.com/bid/95070 http://www.securitytracker.com/id/1037460 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8609 https://access.redhat.com/security/cve/CVE-2016-8609 https://bugzilla.redhat.com/show_bug.cgi?id=1386729 • CWE-287: Improper Authentication CWE-384: Session Fixation •