GitHub Advisoryadvisory · PyPI

GHSA-89c9-3758-737w keycloak-httpd-client-install Insecure Secrets

HIGH Published 2022-05-14 Modified 2023-08-31 Official page ↗
Aliases
CVE-2017-15112
Ecosystem
PyPI
Packages
keycloak-httpd-client-install
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2023-07-26

Affected packages

• PyPI keycloak-httpd-client-install: < 0.8 → fixed in 0.8

Description

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.

Related

Alias · CVE (1)

  • CVE-2017-15112 keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References