REDHAT-BUG-2322096
First published: Mon Oct 28 2024(Updated: )
Sensitive runtime values in Keycloak (up to version 26.0.2) are captured during the build process as default values embedded in bytecode, potentially exposing them during runtime. Affected options include those with the "kc" prefix, SPI runtime options, and Quarkus properties. Environment variables set directly in Keycloak 26 or indirectly in all versions expand unconditionally due to PropertyMapper logic, embedding sensitive data into the bytecode. This unintentional behavior risks sensitive information exposure in production builds.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Keycloak | <26.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2322096?
The severity of REDHAT-BUG-2322096 is considered high due to the potential exposure of sensitive runtime values.
How do I fix REDHAT-BUG-2322096?
To fix REDHAT-BUG-2322096, upgrade Keycloak to a version later than 26.0.2 that addresses this vulnerability.
What are the affected software versions for REDHAT-BUG-2322096?
Keycloak versions up to 26.0.2 are affected by REDHAT-BUG-2322096.
What types of sensitive values are exposed in REDHAT-BUG-2322096?
Sensitive values exposed in REDHAT-BUG-2322096 include those with the "kc" prefix, SPI runtime options, and Quarkus properties.
Is environment variable information at risk in REDHAT-BUG-2322096?
Yes, environment variable information may also be at risk due to the sensitive runtime values captured during the build process in REDHAT-BUG-2322096.
- agent/severity
- agent/type
- agent/first-publish-date
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-10451
- agent/last-modified-date
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/keycloak
- canonical/red hat keycloak