Vulnerability GHSA-g6qq-c9f9-2772
Medium Risk
MEDIUM RISK
CVSS Score: 5.7
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
February 05, 2025 at 09:18 PM UTC
Keycloak on Quarkus CLI option for encrypted JGroups ignored
25.0.0 - 26.0.5
25.0.0 - 26.0.5
Summary
Keycloak on Quarkus CLI option for encrypted JGroups ignored
Details
The env option KC_CACHE_EMBEDDED_MTLS_ENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
8 months ago
Keycloak logs sensitive headers
12.0.0 - 26.5.5 GHSA-gv3v-2cpp-3pmq
12.0.0 - 26.5.5 GHSA-gv3v-2cpp-3pmq
Low Risk
9 months ago
Keycloak has an improper input validation vulnerability
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
Low Risk
11 months ago
Keycloak unable to restrict access to the admin console
12.0.0 - 26.4.3 GHSA-vjr8-56p3-fmqq
12.0.0 - 26.4.3 GHSA-vjr8-56p3-fmqq
Medium Risk
1 year ago
Denial of Service in Keycloak Server via Security Headers
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
Medium Risk
1 year ago
Keycloak allows unrestricted admin use of system and environment variables
12.0.0 - 26.0.7 GHSA-f4v7-3mww-9gc2
12.0.0 - 26.0.7 GHSA-f4v7-3mww-9gc2
Impacted packages
Timeline
Published
1 year ago
February 05, 2025 at 09:18 PM UTC
Fixed (26.0.6)
Unknown
Unknown
Last Modified
1 year ago
February 05, 2025 at 09:42 PM UTC