Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-15112: In keycloak-http-client-install prior to version 0.8, the admin password could be provided through a command-line argument. This might result in the password being leaked through shell history, or becoming visible to a local attacker at the time the program is running. 99999: CVE-2017-15112 keycloak-httpd-client-install: unsafe use of -p/--admin-password on command line CVE-2017-15111: It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service. 99999: CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloak_cli.py
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | keycloak-httpd-client-install | 0:0.8-1.amzn2 |
| Amazon Linux · 2 | python2-keycloak-httpd-client-install | 0:0.8-1.amzn2 |
Vulnerabilities 2
-
High 7.8
keycloak-httpd-client-install Insecure Secrets
keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.
-
Medium 5.5
keycloak-httpd-client-install symlink attack vulnerability
keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.