Red Hat JBoss Data Grid: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• High 7.5
  CVE-2023-31582

  jose4j uses weak cryptographic algorithm

  jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

  org.bitbucket.b_c:jose4j libjose4j-java libjose4j-java Debian Ubuntu Maven
  Oct 24, 2023
• High 7.4
  CVE-2023-4586

  Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack

  A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

  Red Hat Red Hat Data Grid 8.4.6 wavefront-proxy Wolfi
  Oct 4, 2023
• High 7.2
  CVE-2023-5384

  Infinispan: credentials returned from configuration as clear text

  A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

  Red Hat Red Hat Data Grid 8.4.6 org.infinispan:infinispan-core org.infinispan:infinispan-cachestore-jdbc-common Maven
  Dec 18, 2023

Revision history

1. 2024-01-25 #2

   Neue Updates von NetApp aufgenommen

2. 2023-12-06 #1

   Initiale Fassung

References

• Red Hat Security Advisory vom 2023-12-06
  https://access.redhat.com/errata/RHSA-2023:7676
• NetApp Security Advisory NTAP-20240125-0004 vom 2024-01-25
  https://security.netapp.com/advisory/ntap-20240125-0004/