mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-3hrr-xwvg-hxvr GHSA-cq42-vhv7-xr7p GHSA-vvf8-2h68-9475 GHSA-w8gr-xwp4-r9f7
This commit is contained in:
advisory-database[bot]
@@ -1,13 +1,12 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3hrr-xwvg-hxvr",
|
||||
"modified": "2024-06-11T18:15:33Z",
|
||||
"modified": "2024-12-20T17:54:08Z",
|
||||
"published": "2024-02-29T03:33:17Z",
|
||||
"aliases": [
|
||||
"CVE-2024-1722"
|
||||
],
|
||||
"summary": "Keycloak DoS via account lockout",
|
||||
"details": "A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.",
|
||||
"withdrawn": "2024-12-20T17:54:08Z",
|
||||
"aliases": [],
|
||||
"summary": "Duplicate Advisory: Keycloak DoS via account lockout",
|
||||
"details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cq42-vhv7-xr7p. This link is maintained to preserve external references.\n\n# Original Description\nA flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
|
||||
@@ -1,9 +1,11 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-cq42-vhv7-xr7p",
|
||||
"modified": "2024-06-12T19:42:21Z",
|
||||
"modified": "2024-12-20T17:54:23Z",
|
||||
"published": "2024-06-12T19:42:21Z",
|
||||
"aliases": [],
|
||||
"aliases": [
|
||||
"CVE-2024-1722"
|
||||
],
|
||||
"summary": "Keycloak Denial of Service via account lockout",
|
||||
"details": "In any realm set with \"User (Self) registration\" a user that is registered with a username in email format can be \"locked out\" (denied from logging in) using his username.",
|
||||
"severity": [
|
||||
@@ -38,14 +40,30 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-cq42-vhv7-xr7p"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1722"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/issues/29603"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/issues/29603#issuecomment-2127499627"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2024-1722"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265389"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/keycloak/keycloak"
|
||||
|
||||
@@ -1,13 +1,12 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vvf8-2h68-9475",
|
||||
"modified": "2024-11-26T21:32:22Z",
|
||||
"modified": "2024-12-20T17:54:54Z",
|
||||
"published": "2024-09-19T18:30:52Z",
|
||||
"aliases": [
|
||||
"CVE-2024-8883"
|
||||
],
|
||||
"summary": "Keycloak Open Redirect vulnerability",
|
||||
"details": "A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.",
|
||||
"withdrawn": "2024-12-20T17:54:54Z",
|
||||
"aliases": [],
|
||||
"summary": "Duplicate Advisory: Keycloak Open Redirect vulnerability",
|
||||
"details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w8gr-xwp4-r9f7. This link is maintained to preserve external references.\n\n# Original Description\nA misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
|
||||
@@ -1,10 +1,12 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-w8gr-xwp4-r9f7",
|
||||
"modified": "2024-10-14T20:55:22Z",
|
||||
"modified": "2024-12-20T17:55:01Z",
|
||||
"published": "2024-10-14T20:55:22Z",
|
||||
"aliases": [],
|
||||
"summary": "Vulnerable Redirect URI Validation Results in Open Redirect",
|
||||
"aliases": [
|
||||
"CVE-2024-8883"
|
||||
],
|
||||
"summary": "Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect",
|
||||
"details": "A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.",
|
||||
"severity": [
|
||||
{
|
||||
@@ -85,9 +87,85 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-w8gr-xwp4-r9f7"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8883"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/releases/tag/25.0.6"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/keycloak/keycloak"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312511"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2024-8883"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:8826"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:8824"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:8823"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6890"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6889"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6888"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6887"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6886"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6882"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6880"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6879"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:6878"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:10386"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:10385"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
Reference in New Issue
Block a user