Keycloak: cli option for encrypted jgroups ignored
Vulnerability Description
A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10973
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Red Hat would like to thank philliphnguyen for reporting this issue.
References
More from Unknown
View All →Affected Vendor
Unknown
View all reports →