CVE-2017-12159: CSRF
First published: Tue Aug 22 2017(Updated: )
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.keycloak:keycloak-parent | <3.4.0 | 3.4.0 |
| redhat/Keycloak | <3.3.0. | 3.3.0. |
| redhat/Keycloak | <3.4.0. | 3.4.0. |
| Red Hat Single Sign-On | =7.0 | |
| Red Hat Single Sign-On | =7.1 | |
| redhat enterprise Linux server | =6.0 | |
| redhat enterprise Linux server | =7.0 | |
| Red Hat Keycloak |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-12159
- https://access.redhat.com/errata/RHSA-2017:2904
- https://access.redhat.com/errata/RHSA-2017:2905
- https://access.redhat.com/errata/RHSA-2017:2906
- https://bugzilla.redhat.com/show_bug.cgi?id=1484111
- https://web.archive.org/web/20210124113906/http://www.securityfocus.com/bid/101601
- https://github.com/advisories/GHSA-7fmw-85qm-h22p (Advisory)
- http://www.securityfocus.com/bid/101601
- https://issues.jboss.org/browse/KEYCLOAK-5234
- https://github.com/keycloak/keycloak/blob/1.3.1.Final/services/src/main/java/org/keycloak/services/resources/WelcomeResource.java
Frequently Asked Questions
What is the severity of CVE-2017-12159?
CVE-2017-12159 has a medium severity rating due to its potential for information disclosure and unauthorized access to authenticated user sessions.
How do I fix CVE-2017-12159?
To fix CVE-2017-12159, update Keycloak to a version greater than 3.4.0 or to 3.3.0 for Red Hat's Keycloak.
Which software is affected by CVE-2017-12159?
CVE-2017-12159 affects Keycloak versions up to 3.4.0 and Red Hat Single Sign-On versions up to 7.1.
What type of attack can be conducted using CVE-2017-12159?
An attacker can exploit CVE-2017-12159 to hijack an authenticated user session using the non-unique CSRF prevention cookie.
Is CVE-2017-12159 relevant to Red Hat Enterprise Linux?
CVE-2017-12159 is not directly relevant to Red Hat Enterprise Linux as it specifically pertains to Keycloak and related software.
- collector/github-advisory
- alias/GHSA-7fmw-85qm-h22p
- alias/CVE-2017-12159
- collector/github-advisory-latest
- agent/author
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/event
- agent/trending
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/maven
- package-manager/redhat
- vendor/redhat
- canonical/red hat single sign-on
- version/red hat single sign-on/7.0
- version/red hat single sign-on/7.1
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- vendor/keycloak
- canonical/red hat keycloak