VULNERABILITY INTELLIGENCE

CVE-2017-2585

CVSS score5.9 MEDIUM

EPSS probability1.97%

CISA KEVNot currently listed

Published2018-03-12

Last modified2026-06-17

Description

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.