GitHub Advisoryadvisory · Maven

GHSA-gc7q-jgjv-vjr2 Keycloak Services has a potential bypass of brute force protection

MEDIUM Published 2024-09-17 Modified 2024-09-17 Official page ↗
Aliases
CVE-2024-4629
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-307, CWE-837
Reviewed
2024-09-17

Affected packages

• Maven org.keycloak:keycloak-services: < 22.0.12 → fixed in 22.0.12 • Maven org.keycloak:keycloak-services: >= 23.0.0, < 24.0.7 → fixed in 24.0.7 • Maven org.keycloak:keycloak-services: >= 25.0.0, < 25.0.4 → fixed in 25.0.4

Description

If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user. Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

Related

Alias · CVE (1)

  • CVE-2024-4629 A vulnerability was found in Keycloak. vulnerability

Weakness · CWE (2)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness
  • CWE-837 Improper Enforcement of a Single, Unique Action weakness

References