Bug 2322096 (CVE-2024-10451)

Summary: CVE-2024-10451 org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, drichtar, fjuma, istudens, ivassile, iweiss, jkoops, lgao, mosmerov, msochure, msvehla, nwallace, pdrozd, peholase, pesilva, pjindal, pmackay, pskopek, rmartinc, rowaters, rstancel, security-response-team, smaestri, sthorger, tom.jenkinson
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2024-11-21   

Description OSIDB Bzimport 2024-10-28 07:40:12 UTC 
Sensitive runtime values in Keycloak (up to version 26.0.2) are captured during the build process as default values embedded in bytecode, potentially exposing them during runtime. Affected options include those with the "kc" prefix, SPI runtime options, and Quarkus properties. Environment variables set directly in Keycloak 26 or indirectly in all versions expand unconditionally due to PropertyMapper logic, embedding sensitive data into the bytecode. This unintentional behavior risks sensitive information exposure in production builds.
Comment 2 errata-xmlrpc 2024-11-21 19:23:27 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 24

Via RHSA-2024:10175 https://access.redhat.com/errata/RHSA-2024:10175
Comment 3 errata-xmlrpc 2024-11-21 19:23:57 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 24.0.9

Via RHSA-2024:10176 https://access.redhat.com/errata/RHSA-2024:10176
Comment 4 errata-xmlrpc 2024-11-21 19:24:30 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 26.0

Via RHSA-2024:10177 https://access.redhat.com/errata/RHSA-2024:10177
Comment 5 errata-xmlrpc 2024-11-21 19:24:54 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 26.0.6

Via RHSA-2024:10178 https://access.redhat.com/errata/RHSA-2024:10178
Comment 6 Chess Hazlett 2024-11-27 20:41:57 UTC 
commit: https://github.com/keycloak/keycloak/pull/35246/files