GHSA-w6gv-3r3v-gwgjMediumCVSS 5.9

keycloak-core vulnerable to timing attacks against JWS token verification

Published
October 18, 2018
Last Modified
September 7, 2023

🔗 CVE IDs covered (1)

CVE-2017-2585 →

📋 Description

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

🎯 Affected products1

  • maven/org.keycloak:keycloak-core:< 2.5.1

🔗 References (8)