Moderate severityNVD Advisory· Published Mar 24, 2020· Updated Aug 4, 2024

CVE-2020-1744

Description

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.keycloak:keycloak-coreMaven	< 9.0.1	9.0.1

Affected products

ghsa-coords6 versions
pkg:maven/org.keycloak/keycloak-core pkg:rpm/opensuse/ansible-10&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ansible-11&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ansible-12&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ansible-13&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ansible-9&distro=openSUSE%20Tumbleweed
< 9.0.1+ 5 more
- (no CPE)range: < 9.0.1
- (no CPE)range: < 10.6.0-1.1
- (no CPE)range: < 11.11.0-1.1
- (no CPE)range: < 12.2.0-1.1
- (no CPE)range: < 13.7.0-1.1
- (no CPE)range: < 9.8.0-1.1
Red Hat/Keycloakcpe-rescue
Range: all keycloak versions prior to 9.0.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-4gf2-xv97-63m2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-1744ghsaADVISORY
access.redhat.com/security/cve/CVE-2020-1744ghsaWEB
bugzilla.redhat.com/show_bug.cgighsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000