Lucene search

[email protected]NVD:CVE-2024-4629

HistorySep 03, 2024 - 8:15 p.m.

CVE-2024-4629

2024-09-0320:15:09

CWE-837

[email protected]

web.nvd.nist.gov

keycloak

brute force protection

timing loophole

account security

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

36.9%

JSON

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

Affected configurations

Nvd

Node

redhatkeycloakRange<24.0.3

Node

redhatbuild_of_keycloakRange22.0–22.012

Node

redhatsingle_sign-onMatch-text-only

Node

redhatsingle_sign-onRange7.6–7.6.10

AND

redhatenterprise_linuxMatch7.0

redhatenterprise_linuxMatch8.0

redhatenterprise_linuxMatch9.0

Node

redhatopenshift_container_platformMatch4.11

redhatopenshift_container_platformMatch4.12

redhatopenshift_container_platform_for_linuxoneMatch4.9

redhatopenshift_container_platform_for_linuxoneMatch4.10

redhatopenshift_container_platform_for_powerMatch4.9

redhatopenshift_container_platform_for_powerMatch4.10

redhatopenshift_container_platform_ibm_z_systemsMatch4.9

redhatopenshift_container_platform_ibm_z_systemsMatch4.10

AND

redhatenterprise_linuxMatch8.0

VendorProductVersionCPE
redhatkeycloak*cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
redhatbuild_of_keycloak*cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhatsingle_sign-on-cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
redhatsingle_sign-on*cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatenterprise_linux9.0cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
redhatopenshift_container_platform4.11cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
redhatopenshift_container_platform4.12cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
redhatopenshift_container_platform_for_linuxone4.9cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	keycloak	*	cpe:2.3:a:redhat:keycloak::::::::
redhat	build_of_keycloak	*	cpe:2.3:a:redhat:build_of_keycloak::::::::
redhat	single_sign-on	-	cpe:2.3:a:redhat:single_sign-on:-::::text-only:::
redhat	single_sign-on	*	cpe:2.3:a:redhat:single_sign-on::::::::
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
redhat	enterprise_linux	9.0	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
redhat	openshift_container_platform	4.11	cpe:2.3:a:redhat:openshift_container_platform:4.11:::::::*
redhat	openshift_container_platform	4.12	cpe:2.3:a:redhat:openshift_container_platform:4.12:::::::*
redhat	openshift_container_platform_for_linuxone	4.9	cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:::::::*