Summary
[0.8-1]
- Resolves: rhbz#1673716 - Rebase k-h-c-i to version 0.8
- The rebase also includes fixes for:
- rhbz#1533190 - CVE-2017-15111 keycloak-httpd-client-install: unsafe
/tmp log file in --log-file option in keycloak_cli.py
- rhbz#1533202 - CVE-2017-15112 keycloak-httpd-client-install: unsafe
use of -p/--admin-password on command line
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | keycloak-httpd-client-install | 0:0.8-1.el7 |
| Oracle Linux · 7 | python2-keycloak-httpd-client-install | 0:0.8-1.el7 |
Vulnerabilities 2
-
High 7.8
keycloak-httpd-client-install Insecure Secrets
keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.
-
Medium 5.5
keycloak-httpd-client-install symlink attack vulnerability
keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.