Описание
Keycloak on Quarkus CLI option for encrypted JGroups ignored
The env option KC_CACHE_EMBEDDED_MTLS_ENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644.
Ссылки
- https://github.com/keycloak/keycloak/security/advisories/GHSA-g6qq-c9f9-2772
- https://nvd.nist.gov/vuln/detail/CVE-2024-10973
- https://github.com/keycloak/keycloak/issues/28750
- https://github.com/keycloak/keycloak/issues/34644
- https://github.com/keycloak/keycloak/pull/28756
- https://github.com/keycloak/keycloak/pull/34668
- https://github.com/keycloak/keycloak/commit/071032a108bd9e9fce9e66d00c36d56bd4b334df
- https://github.com/keycloak/keycloak/commit/36defd5f33b2da5d705f179bbaa21c28b13a9996
- https://access.redhat.com/security/cve/CVE-2024-10973
- https://bugzilla.redhat.com/show_bug.cgi?id=2324361
Пакеты
org.keycloak:keycloak-quarkus-server
>= 25.0.0, < 26.0.6
26.0.6
Связанные уязвимости
A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.
A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.
A vulnerability was found in Keycloak. The environment option `KC_CACH ...