GHSA-g6qq-c9f9-2772

Keycloak on Quarkus CLI option for encrypted JGroups ignored

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-10973

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.keycloak:keycloak-quarkus-server	>= 25.0.0, < 26.0.6	26.0.6

Details

As written in the advisory (Markdown source, shown as plain text).

The env option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644.

References

External links from the advisory. They lead to third-party sites.

https://github.com/keycloak/keycloak/security/advisories/GHSA-g6qq-c9f9-2772 web
https://nvd.nist.gov/vuln/detail/CVE-2024-10973 advisory
https://github.com/keycloak/keycloak/issues/28750 web
https://github.com/keycloak/keycloak/issues/34644 web
https://github.com/keycloak/keycloak/pull/28756 web
https://github.com/keycloak/keycloak/pull/34668 web
https://github.com/keycloak/keycloak/commit/071032a108bd9e9fce9e66d00c36d56bd4b334df web
https://github.com/keycloak/keycloak/commit/36defd5f33b2da5d705f179bbaa21c28b13a9996 web
https://access.redhat.com/security/cve/CVE-2024-10973 web
https://bugzilla.redhat.com/show_bug.cgi?id=2324361 web
https://github.com/keycloak/keycloak package