CVE-2018-14657

High

Description

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

SeverityHigh

CVSS8.1

Exploit probability—

Product

Redhat Keycloak

PublishedNov 13, 2018

First seenNov 13, 2018

Weakness typeCWE-307CWE-307

How to fix

Update

org.keycloak:keycloak-parent4.6.0.Final or later

Vendor advisories

access.redhat.com/errata/RHSA-2018:3592
access.redhat.com/errata/RHSA-2018:3593
access.redhat.com/errata/RHSA-2018:3595

Affected products

Product	Affected versions	Fixed in
redhat keycloak	4.2.1, 4.3.0	—
redhat single_sign-on	7.2, No range specified	—
org.keycloak:keycloak-parentMaven	v < 4.6.0.Final	4.6.0.Final

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.