diff --git a/advisories/github-reviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json b/advisories/github-reviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json index 7b6e09db5aa..064c1d79945 100644 --- a/advisories/github-reviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json +++ b/advisories/github-reviewed/2024/02/GHSA-3hrr-xwvg-hxvr/GHSA-3hrr-xwvg-hxvr.json @@ -1,13 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3hrr-xwvg-hxvr", - "modified": "2024-06-11T18:15:33Z", + "modified": "2024-12-20T17:54:08Z", "published": "2024-02-29T03:33:17Z", - "aliases": [ - "CVE-2024-1722" - ], - "summary": "Keycloak DoS via account lockout", - "details": "A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.", + "withdrawn": "2024-12-20T17:54:08Z", + "aliases": [], + "summary": "Duplicate Advisory: Keycloak DoS via account lockout", + "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cq42-vhv7-xr7p. This link is maintained to preserve external references.\n\n# Original Description\nA flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/06/GHSA-cq42-vhv7-xr7p/GHSA-cq42-vhv7-xr7p.json b/advisories/github-reviewed/2024/06/GHSA-cq42-vhv7-xr7p/GHSA-cq42-vhv7-xr7p.json index afc445d4e9e..1b03472d8a1 100644 --- a/advisories/github-reviewed/2024/06/GHSA-cq42-vhv7-xr7p/GHSA-cq42-vhv7-xr7p.json +++ b/advisories/github-reviewed/2024/06/GHSA-cq42-vhv7-xr7p/GHSA-cq42-vhv7-xr7p.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-cq42-vhv7-xr7p", - "modified": "2024-06-12T19:42:21Z", + "modified": "2024-12-20T17:54:23Z", "published": "2024-06-12T19:42:21Z", - "aliases": [], + "aliases": [ + "CVE-2024-1722" + ], "summary": "Keycloak Denial of Service via account lockout", "details": "In any realm set with \"User (Self) registration\" a user that is registered with a username in email format can be \"locked out\" (denied from logging in) using his username.", "severity": [ @@ -38,14 +40,30 @@ "type": "WEB", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-cq42-vhv7-xr7p" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1722" + }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/issues/29603" }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/issues/29603#issuecomment-2127499627" + }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e" }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-1722" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265389" + }, { "type": "PACKAGE", "url": "https://github.com/keycloak/keycloak" diff --git a/advisories/github-reviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json b/advisories/github-reviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json index 5b0478841e1..62107c64426 100644 --- a/advisories/github-reviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json +++ b/advisories/github-reviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json @@ -1,13 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vvf8-2h68-9475", - "modified": "2024-11-26T21:32:22Z", + "modified": "2024-12-20T17:54:54Z", "published": "2024-09-19T18:30:52Z", - "aliases": [ - "CVE-2024-8883" - ], - "summary": "Keycloak Open Redirect vulnerability", - "details": "A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.", + "withdrawn": "2024-12-20T17:54:54Z", + "aliases": [], + "summary": "Duplicate Advisory: Keycloak Open Redirect vulnerability", + "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w8gr-xwp4-r9f7. This link is maintained to preserve external references.\n\n# Original Description\nA misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/10/GHSA-w8gr-xwp4-r9f7/GHSA-w8gr-xwp4-r9f7.json b/advisories/github-reviewed/2024/10/GHSA-w8gr-xwp4-r9f7/GHSA-w8gr-xwp4-r9f7.json index c1649da9e24..f8cf0185a8a 100644 --- a/advisories/github-reviewed/2024/10/GHSA-w8gr-xwp4-r9f7/GHSA-w8gr-xwp4-r9f7.json +++ b/advisories/github-reviewed/2024/10/GHSA-w8gr-xwp4-r9f7/GHSA-w8gr-xwp4-r9f7.json @@ -1,10 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-w8gr-xwp4-r9f7", - "modified": "2024-10-14T20:55:22Z", + "modified": "2024-12-20T17:55:01Z", "published": "2024-10-14T20:55:22Z", - "aliases": [], - "summary": "Vulnerable Redirect URI Validation Results in Open Redirect", + "aliases": [ + "CVE-2024-8883" + ], + "summary": "Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect", "details": "A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.", "severity": [ { @@ -85,9 +87,85 @@ "type": "WEB", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-w8gr-xwp4-r9f7" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8883" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/releases/tag/25.0.6" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java" + }, { "type": "PACKAGE", "url": "https://github.com/keycloak/keycloak" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312511" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-8883" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8826" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8824" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8823" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6890" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6889" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6888" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6887" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6886" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6882" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6880" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6879" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6878" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:10386" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:10385" } ], "database_specific": {