Bug 1511623 (CVE-2017-15111) - CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloak_cli.py
Summary: CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-f...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-15111
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1531296 1531338 1531339 1531340 1533190
Blocks: 1517252
TreeView+ depends on / blocked
 
Reported: 2017-11-09 18:02 UTC by Pedro Sampaio
Modified: 2021-08-11 12:19 UTC (History)
21 users (show)

Fixed In Version: keycloak 0.8
Doc Type: If docs needed, set a value
Doc Text:
It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service.
Clone Of:
Environment:
Last Closed: 2019-08-06 13:18:28 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2137 0 None None None 2019-08-06 12:19:43 UTC

Description Pedro Sampaio 2017-11-09 18:02:36 UTC 
A flaw was discovered in keycloak-httpd-client-install version 0.6-2. The --log-file option in keycloak_cli.py insecurely passes the script name for the log file creation.
Comment 1 John Dennis 2017-11-09 18:52:15 UTC 
Could you please explain the security issue, I do not follow from the terse "insecurely passes the script name for the log file creation" phrase.
Comment 9 Summer Long 2018-01-04 23:01:31 UTC 
Created keycloak-httpd-client-install tracking bugs for this issue:

Affects: fedora-all [bug 1531296]
Comment 15 Adam Mariš 2018-01-19 16:31:14 UTC 
Upstream fix:

https://github.com/jdennis/keycloak-httpd-client-install/commit/07f26e213196936fb328ea0c1d5a66a09d8b5440
Comment 17 Andrej Nemec 2018-05-14 12:21:37 UTC 
Statement:

Red Hat Product Security has rated this issue as having security impact of Low. This issue may be fixed in a future version of Red Hat Enterprise Linux.

OpenStack users please note, this issue is present in:
* Red Hat OpenStack Platform 9.0 (Mitaka)
* Red Hat OpenStack Platform 10.0 (Newton) 
* Red Hat OpenStack Platform 11.0 (Ocata)

If a fixed version of keycloak-httpd-client-install is made available in Red Hat Enterprise Linux, OpenStack customers should consume this package directly from the Red Hat Enterprise Linux channel (this occurs during normal updates).
Comment 18 errata-xmlrpc 2019-08-06 12:19:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2137 https://access.redhat.com/errata/RHSA-2019:2137
Comment 19 Product Security DevOps Team 2019-08-06 13:18:28 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-15111
Note You need to log in before you can comment on or make changes to this bug.