CVE-2024-4629
Medium
Description
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Redhat Keycloak
PublishedSep 3, 2024
First seenSep 3, 2024
Weakness typeCWE-837CWE-837
How to fix
Update
- redhat keycloak24.0.3 or later
- redhat build_of_keycloak22.012 or later
- redhat single_sign-on7.6.10 or later
- org.keycloak:keycloak-services22.0.12, 24.0.7, 25.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat keycloak | v < 24.0.3 | 24.0.3 |
| redhat build_of_keycloak | 22.0 ≤ v < 22.012 | 22.012 |
| redhat single_sign-on | No range specified, 7.6 ≤ v < 7.6.10 | 7.6.10 |
| redhat openshift_container_platform | 4.11, 4.12 | — |
| redhat openshift_container_platform_for_linuxone | 4.9, 4.10 | — |
| redhat openshift_container_platform_for_power | 4.9, 4.10 | — |
| redhat openshift_container_platform_ibm_z_systems | 4.9, 4.10 | — |
| org.keycloak:keycloak-servicesMaven | v < 22.0.12, 23.0.0 ≤ v < 24.0.7, 25.0.0 ≤ v < 25.0.4 | 22.0.12, 24.0.7, 25.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.