PT-2018-12647 · Red Hat · Keycloak

Laura Pardo · Publicado 2018-11-13 · Atualizado 2023-02-02 · CVE-2018-14657

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions 4.2.1.Final, 4.3.0.Final

Description A flaw was found in the implementation of the Brute Force detection algorithm when TOPT is enabled, which will not enforce its protection measures.

Recommendations For Keycloak version 4.2.1.Final, update to a version that fixes this issue. For Keycloak version 4.3.0.Final, update to a version that fixes this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2018-14657

GHSA-85V8-VX4W-Q684

RHSA-2018:3592

RHSA-2018:3593

Produtos afetados

Keycloak

Referências · 8

• https://github.com/keycloak/keycloak · Nota
• https://access.redhat.com/errata/RHSA-2018:3593 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-14657 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14657 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:3595 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:3592 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-85v8-vx4w-q684 · Aviso do Fabricante