PatchTheCVEkeyrock vulnerabilities and fixes
Recent CVEs affecting keyrock, with upgrade or downgrade steps. 5 tracked.
keyrock has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2024-08-12. Highest priority: CVE-2024-42167 (score 47/100).
- CVE-2024-42167 CRITICAL 9.1 UPGRADE The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutr
- CVE-2024-42166 CRITICAL 9.1 UPGRADE The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutrali
- CVE-2024-42165 MEDIUM 6.3 UPGRADE Insufficiently random values for generating activation token in FIWARE Keyrock <= 8.4 allow attackers to activ
- CVE-2024-42164 MEDIUM 4.3 UPGRADE Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to d
- CVE-2024-42163 HIGH 8.3 UPGRADE Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to t
FAQ
How do I fix keyrock vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is keyrock being exploited right now?
None of the tracked keyrock CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which keyrock CVE should I patch first?
CVE-2024-42167 currently ranks highest (47/100): The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutr.