{"action":"Upgrade org.keycloak:keycloak-core to 2.5.1 or later.","affected":[{"fixed":"2.5.1","introduced":"0"}],"component":"org.keycloak:keycloak-core","cve_ids":["CVE-2017-2585"],"ecosystem":"Maven","epss":0.01974,"exploited":false,"fixed_versions":["2.5.1"],"ghsa_id":"GHSA-w6gv-3r3v-gwgj","id":"tcs_01M5N9FR5KXRM6FYJQYZBRX1M3","modified_at":"2024-02-16T07:58:50.193955Z","published_at":"2018-10-18T16:47:41Z","references":["https://osv.dev/vulnerability/GHSA-w6gv-3r3v-gwgj","https://nvd.nist.gov/vuln/detail/CVE-2017-2585","https://access.redhat.com/errata/RHSA-2017:0872","https://access.redhat.com/errata/RHSA-2017:0873","https://bugzilla.redhat.com/show_bug.cgi?id=1412376","https://github.com/advisories/GHSA-w6gv-3r3v-gwgj","https://web.archive.org/web/20170420113802/http://www.securitytracker.com/id/1038180","https://web.archive.org/web/20200227175650/http://www.securityfocus.com/bid/97393","http://rhn.redhat.com/errata/RHSA-2017-0876.html"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-w6gv-3r3v-gwgj","url":"https://osv.dev/vulnerability/GHSA-w6gv-3r3v-gwgj"}],"summary":"keycloak-core vulnerable to timing attacks against JWS token verification"}