PT-2024-1836 · Red Hat · Keycloak

Nick Tait · Published 2024-02-21 · Updated 2025-02-14 · CVE-2024-1722

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak, which may allow a remote unauthenticated attacker to block other accounts from logging in under certain conditions. This issue is related to an overly restrictive mechanism for blocking user credentials. In realms set with "User (Self) registration", a user registered with a username in email format can be locked out using their username.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Resource Release

Weakness Enumeration

CWE-645

CWE-404

CWE-640

Related Identifiers

BDU:2024-01582

CVE-2024-1722

GHSA-3HRR-XWVG-HXVR

GHSA-CQ42-VHV7-XR7P

Affected Products

Keycloak

References · 48

• https://nvd.nist.gov/vuln/detail/CVE-2024-1722 · Security Note
• https://osv.dev/vulnerability/GHSA-cq42-vhv7-xr7p · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01582 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1722 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hrr-xwvg-hxvr · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/29603#issuecomment-2127499627 · Note
• https://github.com/keycloak/keycloak/issues/29603 · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-cq42-vhv7-xr7p · Note
• https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e · Note
• https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262217 · Note
• https://access.redhat.com/security/cve/CVE-2024-1722 · Note
• https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262222 · Note
• https://twitter.com/CVEnew/status/1762536229151907888 · Twitter Post
• https://security.snyk.io/vuln/SNYK-RHEL8-CONTAINERTOOLS-6262219 · Note