Skip to content
OpenAdvisories
High RHSA-2017:2905 5 CVEs

Red Hat Security Advisory: rh-sso7-keycloak security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el7 rh-sso7-keycloak 0:2.5.14-1.Final_redhat_1.1.jbcs.el7
Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7::el7 rh-sso7-keycloak-server 0:2.5.14-1.Final_redhat_1.1.jbcs.el7

Vulnerabilities 5

  • High 7.5
    CVE-2014-9970

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt

    jasypt before 1.9.2 allows a timing attack against the password hash comparison.

    jasypt org.jasypt:jasypt jasypt Debian Ubuntu Maven
  • High 7.5
    CVE-2017-12159

    Keycloak CSRF Vulnerability

    It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • High 7.2
    CVE-2017-12160

    Keycloak Oauth Implementation Error

    It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource cou…

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 6.5
    CVE-2017-12197

    Improper Input Validation in libpam4j

    It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

    Red Hat libpam4j org.kohsuke:libpam4j libpam4j Ubuntu Maven
  • Medium 5.4
    CVE-2017-12158

    Keycloak Reflected XSS

    It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

    Red Hat keycloak org.keycloak:keycloak-parent Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.1/html/release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1484111
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1484154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1489161
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1503103
  • article
    https://issues.redhat.com/browse/RHSSO-1122
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2905.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-9970
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1455566
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-9970
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-9970
  • report
    https://access.redhat.com/security/cve/CVE-2017-12158
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12158
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12158
  • report
    https://access.redhat.com/security/cve/CVE-2017-12159
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12159
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12159
  • report
    https://access.redhat.com/security/cve/CVE-2017-12160
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12160
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12160
  • report
    https://access.redhat.com/security/cve/CVE-2017-12197
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12197