PT-2024-16676 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A vulnerability was found in Keycloak where the environment option KC CACHE EMBEDDED MTLS ENABLED does not work, and the JGroups replication configuration is always used in plain text. Thi...

CVE-2024-10973

A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information...

Red Hat Keycloak 安全漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from the environment option not working and the JGroups replication configuratio...

SUSE CVE-2012-2377

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a...

SUSE CVE-2016-2141

It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information...

co.paralleluniverse:galaxy (>=1.1 <=1.2), co.paralleluniverse:quasar-galaxy (=0.2.0) +386 more potentially affected by CVE-2013-4112 via org.jgroups:jgroups (>=3.0.0.CR1 <=3.2.8.Final)

org.jgroups:jgroups MAVEN version =3.0.0.CR1, =1.1, =1.0.0-1, =1.0.7364, =1.0d13, =1.0d18, =1.0d13, =1.0d13, =0.13.1, =0.7.3, =0.8.0, =0.9.0 and more Source cves: CVE-2013-4112 Source advisory: OSV:GHSA-CC62-496P-HRR7...

com.coherentlogic.fred.client:fred-client-webstart-application (>=0.9.11 <=1.0.9-RELEASE), com.nimbusds:common (>=1.70 <=1.74) +116 more potentially affected by CVE-2013-4112 via org.jgroups:jgroups (>=3.3.0.CR1 <=3.3.2.Final)

org.jgroups:jgroups MAVEN version =3.3.0.CR1, =0.9.11, =1.70, =1.0, =1.5.1, =1.1, =1.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.5.0, =2.5.0, =2.5.0, =2.5.0, =2.5.3 and more Source cves: CVE-2013-4112 Source advisory: OSV:GHSA-CC62-496P-HRR7...

Uncontrolled Resource Consumption in Artemis and HornetQ

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError...

GHSA-GC96-H5PR-839J Uncontrolled Resource Consumption in Artemis and HornetQ

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError...

co.paralleluniverse:galaxy (>=1.1 <=1.2), co.paralleluniverse:quasar-galaxy (=0.2.0) +352 more potentially affected by CVE-2016-2141 via org.jgroups:jgroups (>=3.0.0.CR1 <=3.2.13.Final)

org.jgroups:jgroups MAVEN version =3.0.0.CR1, =1.1, =1.0.0-1, =1.0.7364, =1.0d13, =1.0d18, =1.0d13, =1.0d13, =0.13.1, =0.7.3, =0.8.0, =0.6.0, =1.0.1 and more Source cves: CVE-2016-2141 Source advisory: OSV:GHSA-RC7H-X6CQ-988Q...

co.jufeng:jufeng-dao (>=1.0.0 <=1.0.1), co.paralleluniverse:galaxy (>=1.2.1 <=1.4) +487 more potentially affected by CVE-2016-2141 via org.jgroups:jgroups (>=3.3.0.CR1 <=3.6.0.Final)

org.jgroups:jgroups MAVEN version =3.3.0.CR1, =1.0.0, =1.2.1, =0.3.0, =1.0.2-1, =0.9.11, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2016-2141 Source advisory: OSV:GHSA-RC7H-X6CQ-988Q...

Improper Input Validation in JGroups

JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backport...

GHSA-RC7H-X6CQ-988Q Improper Input Validation in JGroups

JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backport...

artemis/hornetq: memory exhaustion via UDP and JGroups discovery

It was found that when Artemis and HornetQ are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError...

Critical: Red Hat Security Advisory: EAP Continuous Delivery Technical Preview Release 12 security update

This is a security update for JBoss EAP Continuous Delivery 12.0. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Privilege Escalation

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Privilege Escalation

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Information Disclosure

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

Information Disclosure

An attack technique against the W3C XML Encryption Standard when block ciphers were used in CBC mode could allow a remote attacker to conduct chosen-ciphertext attacks, leading to the recovery of the entire plain text of a particular cryptogram. CVE-2011-1096 JBoss Web Services leaked side-channe...

RHEL 6 / 7 : Red Hat JBoss Enterprise Application Platform 7.0 (RHSA-2016:1332)

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2016:1332 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly. This asynchronous patch is a security updat...