system
Describe <CVE-2017-2585>.
user
What is <CVE-2017-2585>?
assistant
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks..