CVE-2024-10973 — Keycloak: cli option for encrypted jgroups ignored
A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain te…
Published: 2024-12-17 · CVSS: 5.7 · CVSS 3.1
A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7