CVE-2024-10973

A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

Score

CVSS 3.1 5.7 Medium

Status

Deferred - secalert@redhat.com

Published

2024-12-17

Last modified

2026-08-08

Weaknesses

CWE-319

Affected products

• Build Keycloak (Redhat)
• Jboss Enterprise Application Platform (Redhat)
• Jbosseapxp (Redhat)

References

• https://access.redhat.com/security/cve/CVE-2024-10973
• https://bugzilla.redhat.com/show_bug.cgi?id=2324361