PT-2024-31946 · Red Hat · Keycloak

Maurizio Agazzini · Published 2024-09-03 · Updated 2024-09-17 · CVE-2024-4629

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in Keycloak allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-837

Related Identifiers

CVE-2024-4629

GHSA-8WM9-24QG-M5QJ

GHSA-GC7Q-JGJV-VJR2

RHSA-2024:6493

RHSA-2024:6494

RHSA-2024:6495

Affected Products

Keycloak

References · 30

• https://access.redhat.com/errata/RHSA-2024:6500 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:6497 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:6501 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:6495 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2024-4629 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8wm9-24qg-m5qj · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2276761 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:6493 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:6494 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gc7q-jgjv-vjr2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4629 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4629 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:6499 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/c8053dd812d9b9f05b293f901b9dc39e061ebb88 · Note