CVE-2017-2585

CVE-2017-2585 describes a timing attack vulnerability in Red Hat Keycloak versions prior to 2.5.1, as well as Red Hat Enterprise Linux Server and Red Hat Single Sign-On. The vulnerability stems from a non-constant time HMAC verification method for JWS tokens, allowing an attacker to potentially deduce sensitive information. With a CVSS score of 5.9 (Medium), this vulnerability has a network attack vector and high attack complexity, but could lead to high confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.