Redhat Single Sign On
4 CVEs affecting Redhat Single Sign On. Latest disclosed: 2018-03-12. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12159 | High | 7.5 | 2017-10-26 | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenti… |
CVE-2016-8629 | Medium | 6.5 | 2018-03-12 | Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An atta… |
CVE-2017-2585 | Medium | 5.9 | 2018-03-12 | Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially… |
CVE-2017-12158 | Medium | 5.4 | 2017-10-26 | It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw… |