Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02bXB4LXBtZ3Atd3c0Oc4ABCiJ

Keycloak vulnerable to Cleartext Transmission of Sensitive Information

A vulnerability was found in Keycloak. The environment option KC_CACHE_EMBEDDED_MTLS_ENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

Permalink: https://github.com/advisories/GHSA-6mpx-pmgp-ww49
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02bXB4LXBtZ3Atd3c0Oc4ABCiJ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 29 days ago
Updated: 28 days ago

CVSS Score: 5.7
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.10865

Identifiers: GHSA-6mpx-pmgp-ww49, CVE-2024-10973
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-10973
• https://access.redhat.com/security/cve/CVE-2024-10973
• https://bugzilla.redhat.com/show_bug.cgi?id=2324361
• https://github.com/keycloak/keycloak/issues/28750
• https://github.com/keycloak/keycloak/issues/34644
• https://github.com/keycloak/keycloak/pull/28756
• https://github.com/keycloak/keycloak/pull/34668
• https://github.com/keycloak/keycloak/commit/071032a108bd9e9fce9e66d00c36d56bd4b334df
• https://github.com/keycloak/keycloak/commit/36defd5f33b2da5d705f179bbaa21c28b13a9996
• https://github.com/advisories/GHSA-6mpx-pmgp-ww49

Repository: https://github.com/keycloak/keycloak
Blast Radius: 8.0

Affected Packages