Keycloak 25.0.x < 26.0.6 Information Disclosure (GHSA-6mpx-pmgp-ww49)

Keycloak versions installed prior to 26.0.6 are affected by an information disclosure vulnerability as referenced in the advisory. - A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in...

GHSA-6MPX-PMGP-WW49 Duplicate Advisory: Keycloak vulnerable to Cleartext Transmission of Sensitive Information

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g6qq-c9f9-2772. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroup...

Duplicate Advisory: Keycloak vulnerable to Cleartext Transmission of Sensitive Information

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g6qq-c9f9-2772. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroup...

CVE-2024-10973

A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information...

CVE-2024-10973

A vulnerability was found in Keycloak. The environment option "KCCACHEEMBEDDEDMTLSENABLED" does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information...

CVE-2024-10973 Keycloak: cli option for encrypted jgroups ignored

A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information...

CVE-2024-10973 Keycloak: cli option for encrypted jgroups ignored

A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information...

CVE-2024-10973

Keycloak vulnerability CVE-2024-10973: the KC_CACHE_EMBEDDED_MTLS_ENABLED environment option does not work and JGroups replication is used in plain text, allowing an attacker on adjacent networks to read sensitive information. The issue affects Keycloak deployments relying on this configuration; ...

PT-2024-16676

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A vulnerability was found in Keycloak where the environment option KC CACHE EMBEDDED MTLS ENABLED does not work, and the JGroups replication configuration is always used in plain text. This...

CVE-2024-10973: Cleartext Transmission of Sensitive Information

A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information...

CVE-2024-10973

A vulnerability was found in Keycloak. The environment option KCCACHEEMBEDDEDMTLSENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information...

Red Hat Keycloak security vulnerabilities

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that stems from the environment option not working and the JGroups replication configuratio...

org.elasticsearch:elasticsearch-analysis-icu (0.8.0), org.elasticsearch:elasticsearch-client-groovy (0.8.0) +4 more potentially affected by CVE-2024-23444 via org.elasticsearch:elasticsearch (0.8.0)

org.elasticsearch:elasticsearch MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.8.0 - org.elasticsearch:elasticsearch-client-groov...

org.elasticsearch:elasticsearch-analysis-icu (0.7.1), org.elasticsearch:elasticsearch-client-groovy (0.7.1) +3 more potentially affected by CVE-2023-49921 via org.elasticsearch:elasticsearch (0.7.1)

org.elasticsearch:elasticsearch MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.7.1 - org.elasticsearch:elasticsearch-client-groov...

org.infinispan.wildfly:infinispan-server-commons (11.0.0.alpha), org.infinispan.wildfly:infinispan-server-jgroups (11.0.0.alpha) +69 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (11.0.0.alpha)

org.infinispan:infinispan-commons MAVEN version 11.0.0.alpha is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.wildfly:infinispan-server-commons 11.0.0.alpha -...

org.infinispan.wildfly:infinispan-server-commons (10.1.0.beta1), org.infinispan.wildfly:infinispan-server-jgroups (10.1.0.beta1) +69 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (10.1.0.beta1)

org.infinispan:infinispan-commons MAVEN version 10.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.wildfly:infinispan-server-commons 10.1.0.beta1 -...

org.infinispan.wildfly:infinispan-server-commons (10.1.6.final), org.infinispan.wildfly:infinispan-server-jgroups (10.1.6.final) +72 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (10.1.6.final)

org.infinispan:infinispan-commons MAVEN version 10.1.6.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.wildfly:infinispan-server-commons 10.1.6.final -...

org.infinispan.wildfly:infinispan-server-commons (10.0.0.cr3), org.infinispan.wildfly:infinispan-server-jgroups (10.0.0.cr3) +69 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (10.0.0.cr3)

org.infinispan:infinispan-commons MAVEN version 10.0.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.wildfly:infinispan-server-commons 10.0.0.cr3 -...

org.infinispan.server:infinispan-server-commons (9.2.4.final), org.infinispan.server:infinispan-server-event-logger (9.2.4.final) +86 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (9.2.4.final)

org.infinispan:infinispan-commons MAVEN version 9.2.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.server:infinispan-server-commons 9.2.4.final -...

org.infinispan.server:infinispan-server-commons (9.2.0.beta1), org.infinispan.server:infinispan-server-event-logger (9.2.0.beta1) +63 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (9.2.0.beta1)

org.infinispan:infinispan-commons MAVEN version 9.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - org.infinispan.server:infinispan-server-commons 9.2.0.beta1 -...