2 lines
10 KiB
JSON
2 lines
10 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://github.com/keycloak/keycloak","packageName":"keycloak","versions":[{"status":"affected","version":"24.0.3"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:22"],"defaultStatus":"unaffected","packageName":"org.keycloak-keycloak-parent","product":"Red Hat Build of Keycloak","vendor":"Red Hat"},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:22::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"22.0.12-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:22::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"22-17","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:22::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"22-20","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"defaultStatus":"unaffected","packageName":"org.keycloak-keycloak-parent","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 7","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.16-1.redhat_00001.1.el7sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.16-1.redhat_00001.1.el8sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.16-1.redhat_00001.1.el9sso","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhosemc:1.0::el8"],"defaultStatus":"affected","packageName":"rh-sso-7/sso76-openshift-rhel8","product":"RHEL-8 based Middleware Containers","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"7.6-52","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","packageName":"org.keycloak-keycloak-parent","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*","matchCriteriaId":"EEB94F86-A977-493B-9F12-6991F84F955C","versionEndExcluding":"24.0.3","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*","matchCriteriaId":"395F9BD6-C79B-442A-AA00-F96CA978B910","versionEndExcluding":"22.012","versionStartIncluding":"22.0","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*","matchCriteriaId":"341E6313-20D5-44CB-9719-B20585DC5AD6","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*","matchCriteriaId":"92BC930F-97E8-4FA9-80C5-3A8DB327990B","versionEndExcluding":"7.6.10","versionStartIncluding":"7.6","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*","matchCriteriaId":"EA983F8C-3A06-450A-AEFF-9429DE9A3454","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*","matchCriteriaId":"40449571-22F8-44FA-B57B-B43F71AB25E2","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*","matchCriteriaId":"B02036DD-4489-480B-B7D4-4EB08952377B","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*","matchCriteriaId":"C7E78C55-45B6-4E01-9773-D3468F8EA9C3","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*","matchCriteriaId":"30E2CF79-2D56-48AB-952E-5DDAFE471073","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*","matchCriteriaId":"54E24055-813B-4E6D-94B7-FAD5F78B8537","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*","matchCriteriaId":"CC262C4C-7B6A-4117-A50F-1FF69296DDD8","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*","matchCriteriaId":"E58526FB-522F-4AAC-B03C-9CAB443D0CFF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems."},{"lang":"es","value":"Se encontró una vulnerabilidad en Keycloak. Esta falla permite a los atacantes eludir la protección por fuerza bruta al explotar el tiempo de los intentos de inicio de sesión. Al iniciar múltiples solicitudes de inicio de sesión simultáneamente, los atacantes pueden superar los límites configurados para intentos fallidos antes de que el sistema los bloquee. Esta falla de tiempo permite a los atacantes realizar más intentos de adivinar contraseñas de lo previsto, lo que podría comprometer la seguridad de las cuentas en los sistemas afectados."}],"id":"CVE-2024-4629","lastModified":"2026-06-17T08:02:17.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"secalert@redhat.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4629","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-09-03T20:20:28.329028Z","version":"2.0.3"}}]},"published":"2024-09-03T20:15:09.003","references":[{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:6493"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:6494"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:6495"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:6497"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:6499"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:6500"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2024:6501"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2024-4629"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276761"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/hnsecurity/vulns/blob/main/HNS-2024-09-Keycloak.md"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-837"}],"source":"secalert@redhat.com","type":"Secondary"}]}
|