CVE-2024-1722
published 2024-02-29CVE-2024-1722: A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.77%
51.6th percentile
A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | keycloak | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Keycloak Denial of Service via account lockout
osv·2024-06-12
CVE-2024-1722 [LOW] Keycloak Denial of Service via account lockout
Keycloak Denial of Service via account lockout
In any realm set with "User (Self) registration" a user that is registered with a username in email format can be "locked out" (denied from logging in) using his username.
GHSA
Keycloak Denial of Service via account lockout
ghsa·2024-06-12
CVE-2024-1722 [LOW] CWE-640 Keycloak Denial of Service via account lockout
Keycloak Denial of Service via account lockout
In any realm set with "User (Self) registration" a user that is registered with a username in email format can be "locked out" (denied from logging in) using his username.
Red Hat
kernel: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
vendor_redhat·2025-01-11·CVSS 5.5
CVE-2024-48881 [MEDIUM] CWE-476 kernel: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
kernel: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
In the Linux kernel, the following vulnerability has been resolved:
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in
node allocations") leads a NULL pointer deference in cache_set_flush().
1721 if (!IS_ERR_OR_NULL(c->root))
1722 list_add(&c->root->list, &c->btree_cache);
>From the above code in cache_set_flush(), if previous registration code
fails before allocating c->root, it is possible c->root is NULL as what
it is initialized. __bch_btree_node_alloc() never returns NULL but
c->root is possible to be NULL at above line 1721.
This patch replaces IS_ERR() by IS_ERR_OR_NULL() to fix this.
Package: kernel (Red Hat Enterprise Linux 6) - Not affect
Red Hat
keycloak-core: DoS via account lockout
vendor_redhat·2024-02-21·CVSS 3.7
CVE-2024-1722 [LOW] CWE-645 keycloak-core: DoS via account lockout
keycloak-core: DoS via account lockout
A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
Statement: While this attack enables locking out an individual from their account, the entire system will remain in operation. The follow conditions are required for successful exploitation:
- The realm is configured to use "User (Self) registration"
- The user registers with a username in email format
- The attacker discovers a valid email address for an account
Due to these conditions, the security impact has been rated Low.
Mitigation: Red Hat Product
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-29
Published