CVE-2017-15112: Infoleak
A flaw was discovered in keycloak-httpd-client-install version 0.6-2. The -p/--admin-password option ask for a password through the command line, possibly leaking it via command history.
Other sources
keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15112?
CVE-2017-15112 is classified as a moderate severity vulnerability due to the potential exposure of sensitive information through command line argument history.
How do I fix CVE-2017-15112?
To mitigate CVE-2017-15112, upgrade to keycloak-httpd-client-install version 0.8 or later.
What does CVE-2017-15112 affect?
CVE-2017-15112 affects keycloak-httpd-client-install versions prior to 0.8, allowing insecure password handling.
What are the risks of CVE-2017-15112?
The main risk associated with CVE-2017-15112 is the potential leakage of admin passwords via command history.
Is CVE-2017-15112 related to any specific software?
Yes, CVE-2017-15112 specifically affects the keycloak-httpd-client-install versions prior to 0.8.