GHSA-3hrr-xwvg-hxvr
Duplicate Advisory: Keycloak DoS via account lockout
- Severity
- 3.7 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-645 Overly Restrictive Account Lockout Mechanism
- Fix
24.0.0- Upgrade org.keycloak:keycloak-core to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cq42-vhv7-xr7p. This link is maintained to preserve external references.
Original Description
A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-core | < 24.0.0 |
24.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.keycloak:keycloak-core Maven → 24.0.0
- maven
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-core</artifactId><version>24.0.0</version></dependency>- gradle
implementation("org.keycloak:keycloak-core:24.0.0")
Severity breakdown
CVSS 3.1 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-645: Overly Restrictive Account Lockout Mechanism
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
How to prevent it
- Architecture and Design: Implement more intelligent password throttling mechanisms such as those which take IP address into account, in addition to the login name.
- Architecture and Design: Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.
- Architecture and Design: Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (makes it do some computation).
References
Advisories
Packages
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-q4xq-445g-g6ch Keycloak allows cross-site scripting (XSS) | Low | Also affects org.keycloak:keycloak-core |
| GHSA-93ww-43rr-79v3 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination | High | Also affects org.keycloak:keycloak-core |
| GHSA-w97f-w3hq-36g2 Keycloak Denial of Service vulnerability | High | Also affects org.keycloak:keycloak-core |
| GHSA-xmmm-jw76-q7vg Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-g4gc-rh26-m3p5 Keycloak Open Redirect vulnerability | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-9vm7-v8wj-3fqw keycloak-core: open redirect via "form_post.jwt" JARM response mode | Medium | Also affects org.keycloak:keycloak-core |
| GHSA-5q66-v53q-pm35 Keycloak vulnerable to Plaintext Storage of User Password | High | Also affects org.keycloak:keycloak-core |
| GHSA-5cc8-pgp5-7mpm Keycloak Untrusted Certificate Validation vulnerability | Medium | Also affects org.keycloak:keycloak-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor