Keycloak-server: debug default bind address
Résumé
Keycloak-server: debug default bind address
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch github.com
- report bugzilla.redhat.com
- web access.redhat.com
- web catalog.redhat.com