Skip to content
OpenAdvisories
Low ALAS2-2019-1324 2 CVEs

Low: keycloak-httpd-client-install security update (Amazon Linux 2)

Published Oct 21, 2019 · Updated Oct 23, 2019

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-15112: In keycloak-http-client-install prior to version 0.8, the admin password could be provided through a command-line argument. This might result in the password being leaked through shell history, or becoming visible to a local attacker at the time the program is running. 99999: CVE-2017-15112 keycloak-httpd-client-install: unsafe use of -p/--admin-password on command line CVE-2017-15111: It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service. 99999: CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloak_cli.py

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 keycloak-httpd-client-install 0:0.8-1.amzn2
Amazon Linux · 2 python2-keycloak-httpd-client-install 0:0.8-1.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-15111.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-15112.html