CVE-2018-14657: High severity red hat keycloak vulnerability
Published Sep 4, 2018
·Updated
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
Affected Software
8 affected componentsFixes available
maven/org.keycloak:keycloak-parent<4.6.0.Final
4.6.0.Final
redhat/keycloak<4.6.0.
4.6.0.
redhat keycloak=4.2.1
redhat keycloak=4.3.0
redhat Single Sign-on=7.2
redhat Linux=7.0
redhat Linux=6.0
redhat Single Sign-on
Event History
Nov 13, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionSeverityWeakness
May 13, 2022
Advisory Published
01:12 AM
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2018-14657.
2
What is the severity of CVE-2018-14657?
The severity of CVE-2018-14657 is high.
3
Which versions of Keycloak are affected by CVE-2018-14657?
Keycloak versions 4.2.1.Final and 4.3.0.Final are affected by CVE-2018-14657.
4
How can I fix CVE-2018-14657?
To fix CVE-2018-14657, update Keycloak to version 4.6.0.Final or later.
5
Where can I find more information about CVE-2018-14657?
You can find more information about CVE-2018-14657 in the following references: - [Red Hat Advisory RHSA-2018:3592](https://access.redhat.com/errata/RHSA-2018:3592) - [Red Hat Advisory RHSA-2018:3593](https://access.redhat.com/errata/RHSA-2018:3593) - [Red Hat Advisory RHSA-2018:3595](https://access.redhat.com/errata/RHSA-2018:3595)