Threats Tagged 'cve-2024-4629'

Red Hat Single Sign-On 7.6.10 for OpenShift contains multiple security fixes addressing a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. This update is provided as a new container image for use within OpenShift Container Platform versions 3.10, 3.11, and 4.3. The vulnerabilities have a moderate impact rating and affect on-premise or private cloud deployments.

Red Hat Single Sign-On 7.6.10 for RHEL 9 addresses multiple security issues including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. This update replaces version 7.6.9 and includes bug fixes and enhancements. The vulnerabilities have been rated with moderate severity by Red Hat Product Security. No CVSS scores are provided in the advisory. The update is recommended to mitigate these security risks.

Red Hat has released updated container images for the Red Hat build of Keycloak 22.0.12 to address multiple security issues. These include a potential bypass of brute force protection, a session fixation vulnerability in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. The update is intended for use within OpenShift Container Platform deployments, including on-premise and private cloud environments. The advisory rates the impact as moderate and recommends applying the new images after backing up existing installations.

Red Hat Single Sign-On 7.6.10 for RHEL 8 addresses multiple security issues including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of configured LDAP bind credentials through the Keycloak admin console. This update replaces version 7.6.9 and includes bug fixes and enhancements. The vulnerabilities have been assigned CVEs CVE-2024-4629, CVE-2024-7341, and CVE-2024-5967 respectively. The security impact is rated moderate by Red Hat. No CVSS scores are provided in the advisory. The update is available as a package for Red Hat Enterprise Linux 8 and users are advised to apply it after ensuring all previous errata are installed.

Red Hat has released an update for Red Hat build of Keycloak to version 22.0.12 addressing multiple security issues. The update fixes a potential bypass of brute force protection, a session fixation vulnerability in elytron SAML adapters, and a leak of configured LDAP bind credentials through the Keycloak admin console. These vulnerabilities have a moderate impact rating. The update replaces Red Hat Single Sign-On 7.6 and includes other bug fixes and enhancements.

Red Hat Single Sign-On 7.6.10 for RHEL 7 and 8 addresses multiple security vulnerabilities including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of LDAP bind credentials through the Keycloak admin console. These issues were fixed in this update, which replaces version 7.6.9. The update is rated as having a moderate security impact by Red Hat Product Security.

Red Hat Single Sign-On 7.6.10 addresses multiple security issues including a potential bypass of brute force protection, session fixation in Elytron SAML adapters, and leakage of LDAP bind credentials through the Keycloak admin console. This update replaces version 7.6.9 and includes bug fixes and enhancements. The security impact is rated moderate by Red Hat Product Security. Users are advised to back up their installations before applying the update.

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-4629