Keycloak on Quarkus CLI option for encrypted JGroups ignored
The env option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-10973US | —OT elevated | — | ||
A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2024-10973WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2324361WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://github.com/keycloak/keycloak/commit/071032a108bd9e9fce9e66d00c36d56bd4b334dfWEB
- https://github.com/keycloak/keycloak/commit/36defd5f33b2da5d705f179bbaa21c28b13a9996WEB
- https://github.com/keycloak/keycloak/issues/28750WEB
- https://github.com/keycloak/keycloak/issues/34644WEB
- https://github.com/keycloak/keycloak/pull/28756WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan