PT-2018-12647 · Red Hat · Keycloak

Laura Pardo · Published 2018-11-13 · Updated 2023-02-02 · CVE-2018-14657

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions 4.2.1.Final, 4.3.0.Final

Description A flaw was found in the implementation of the Brute Force detection algorithm when TOPT is enabled, which will not enforce its protection measures.

Recommendations For Keycloak version 4.2.1.Final, update to a version that fixes this issue. For Keycloak version 4.3.0.Final, update to a version that fixes this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2018-14657

GHSA-85V8-VX4W-Q684

RHSA-2018:3592

RHSA-2018:3593

Affected Products

Keycloak

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-14657 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14657 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3592 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3595 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3593 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-85v8-vx4w-q684 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note