CVE-2017-2585

CVE-2017-2585 affects Red Hat Keycloak before version 2.5.1, where JWS token HMAC verification is implemented in non-constant time, potentially enabling timing attacks. Documents across OSV/GHSA/NVD reiterate this exact flaw for Keycloak; no explicit exploit details or affected version ranges bey...

PT-2018-7116

Name of the Vulnerable Software and Affected Versions: Red Hat Keycloak versions prior to 2.5.1 Description: The issue is related to the implementation of HMAC verification for JWS tokens, which uses a method that runs in non-constant time. This potentially leaves the application vulnerable to...

CVE-2017-2585: Exposure of Sensitive Information to an Unauthorized Actor

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks...

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

Code injection

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

PT-2018-8620

Name of the Vulnerable Software and Affected Versions: Cisco node-jose versions prior to 0.11.0 Description: A security issue exists due to the node-jose library following the JSON Web Signature JWS standard for JSON Web Tokens JWTs, which allows a JSON Web Key JWK representing a public key to be...

CVE-2018-0114: Improper Verification of Cryptographic Signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

Timing Attacks

keycloak-core is vulnerable to timing attacks. The vulnerability is possible because the HMAC signature comparison algorithm used by its JWS token code is not performed in constant time. Therefore, an attacker can trigger a timing attack through the JWS tokens...

tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update

An update is now available for Red Hat JBoss Web Server 3 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker...

[SECURITY] Fedora 23 Update: python-jwcrypto-0.3.2-1.fc23

Implements JWK,JWS,JWE specifications using python-cryptography...

[SECURITY] Fedora 24 Update: python-jwcrypto-0.3.2-1.fc24

Implements JWK,JWS,JWE specifications using python-cryptography...

[SECURITY] Fedora 25 Update: python-jwcrypto-0.3.2-1.fc25

Implements JWK,JWS,JWE specifications using python-cryptography...

Forgeable Public/Private Tokens

Overview Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer...

RHEL 7 : JBoss Web Server (RHSA-2015:2660)

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.2 security update

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.2 security update

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each...