CVE-2017-15111
First published: Thu Nov 09 2017(Updated: )
keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/keycloak-httpd-client-install | <0:0.8-1.el7 | 0:0.8-1.el7 |
| pip/keycloak-httpd-client-install | <0.8 | 0.8 |
| redhat/keycloak | <0.8 | 0.8 |
| Keycloak | <0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-15111
- https://github.com/jdennis/keycloak-httpd-client-install/commit/07f26e213196936fb328ea0c1d5a66a09d8b5440
- https://access.redhat.com/errata/RHSA-2019:2137
- https://github.com/advisories/GHSA-vqf9-v3hc-wr54 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1531296
- https://access.redhat.com/security/cve/cve-2017-15111
- https://bugzilla.redhat.com/show_bug.cgi?id=1511623
- https://www.cve.org/CVERecord?id=CVE-2017-15111 https://nvd.nist.gov/vuln/detail/CVE-2017-15111
Frequently Asked Questions
What is the severity of CVE-2017-15111?
CVE-2017-15111 is classified as a medium-severity vulnerability.
How do I fix CVE-2017-15111?
To resolve CVE-2017-15111, upgrade to keycloak-httpd-client-install version 0.8 or higher.
Who is affected by CVE-2017-15111?
CVE-2017-15111 affects keycloak-httpd-client-install versions before 0.8 on both Red Hat and pip installations.
What type of vulnerability is CVE-2017-15111?
CVE-2017-15111 is a symbolic link vulnerability that allows local attackers to overwrite files.
What software packages are impacted by CVE-2017-15111?
The impacted packages include keycloak-httpd-client-install and keycloak versions prior to 0.8.
- collector/redhat-cve
- collector/github-advisory-latest
- alias/GHSA-vqf9-v3hc-wr54
- alias/CVE-2017-15111
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/weakness
- agent/references
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- package-manager/pip
- vendor/keycloak-httpd-client-install project
- canonical/keycloak