CVE-2025-11538
Keycloak-server: debug default bind address
概要
Keycloak-server: debug default bind address
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch github.com
- report bugzilla.redhat.com
- web access.redhat.com
- web catalog.redhat.com