Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 7 enterprise_linux:7::server | keycloak-httpd-client-install | 0:0.8-1.el7 |
| Red Hat · RHEL 7 enterprise_linux:7::server | python2-keycloak-httpd-client-install | 0:0.8-1.el7 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | keycloak-httpd-client-install | 0:0.8-1.el7 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | python2-keycloak-httpd-client-install | 0:0.8-1.el7 |
Vulnerabilities 2
-
High 7.8
keycloak-httpd-client-install Insecure Secrets
keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.
-
Medium 5.5
keycloak-httpd-client-install symlink attack vulnerability
keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.
References
-
article
https://access.redhat.com/security/updates/classification/#low
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1511623
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1511626
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1673716
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2137.json
-
report
https://access.redhat.com/security/cve/CVE-2017-15111
-
advisory
https://www.cve.org/CVERecord?id=CVE-2017-15111
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-15111
-
report
https://access.redhat.com/security/cve/CVE-2017-15112
-
advisory
https://www.cve.org/CVERecord?id=CVE-2017-15112
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-15112