| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | ≥ 23.0.0, < 24.0.7≥ 25.0.0, < 25.0.4< 22.0.12 | 24.0.725.0.422.0.12 |
| build of keycloak | ≥ 22.0, < 22.012 | 22.012 |
| keycloak | < 24.0.3 | 24.0.3 |
| openshift container platform | = 4.11= 4.12 | |
| openshift container platform for linuxone | = 4.10= 4.9 | |
| openshift container platform for power | = 4.10= 4.9 | |
| openshift container platform ibm z systems | = 4.10= 4.9 | |
| single sign-on | ≥ 7.6, < 7.6.10 | 7.6.10 |
If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.
Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free