Description
A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-quarkus-server | >= 25.0.0, < 26.0.6 | 26.0.6 | GHSA-g6qq-c9f9-2772 |
Advisories 1
- WID-SEC-2024-3719 Keycloak: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 17, 2024
References
- https://access.redhat.com/security/cve/CVE-2024-10973 vdb-entry
- RHBZ#2324361 issue-tracking