Bug 1511626 (CVE-2017-15112)
| Summary: | CVE-2017-15112 keycloak-httpd-client-install: unsafe use of -p/--admin-password on command line | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | apevec, chrisw, jdennis, jjoyce, jschluet, kbasil, lhh, lpeer, markmc, mburns, rbryant, rhos-maint, sclewis, security-response-team, slinaber, slong, tdecacqu |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | keycloak 0.8 | Doc Type: | If docs needed, set a value |
| Doc Text: |
In keycloak-http-client-install prior to version 0.8, the admin password could be provided through a command-line argument. This might result in the password being leaked through shell history, or becoming visible to a local attacker at the time the program is running.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:18:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1531307, 1531335, 1531336, 1531337, 1531344, 1531345, 1531346, 1533202 | ||
| Bug Blocks: | 1517252 | ||
|
Description
Pedro Sampaio
2017-11-09 18:15:39 UTC
Created keycloak-httpd-client-install tracking bugs for this issue: Affects: fedora-all [bug 1531307] Upstream fix: https://github.com/jdennis/keycloak-httpd-client-install/commit/c3121b271abaaa1a76de2b9ae89dacde0105cd75 Statement: Red Hat Product Security has rated this issue as having security impact of Low. This issue may be fixed in a future version of Red Hat Enterprise Linux. OpenStack users please note, this issue is present in: * Red Hat OpenStack Platform 9.0 (Mitaka) * Red Hat OpenStack Platform 10.0 (Newton) * Red Hat OpenStack Platform 11.0 (Ocata) If a fixed version of keycloak-httpd-client-install is made available in Red Hat Enterprise Linux, OpenStack customers should consume this package directly from the Red Hat Enterprise Linux channel (this occurs during normal updates). This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2137 https://access.redhat.com/errata/RHSA-2019:2137 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2017-15112 |