Skip to content
OpenAdvisories
High · 8.8 CVE-2017-15089 EUVD-2022-2317GHSA-46r5-59fg-2fjc

Deserialization of Untrusted Data in Infinispan

Published Feb 15, 2018 · Updated Sep 16, 2024 · Assigned by redhat

Vendor: Infinispan Product: infinispan Package: org.infinispan:infinispan-core Ecosystem: Maven

Description

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

Affected products

VendorProductAffectedFixed
Infinispan infinispan before 9.2.0.CR1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 1.5.5.009-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.1.13-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.2.13-6.SP5_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-hibernate +5 5.1.12-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-infinispan +5 8.2.9-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.7-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jackson-core +9 2.8.11-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jboss-ec2-eap +1 7.1.1-3.1.GA_redhat_3.ep7.el6 RHSA-2018:0481
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.0.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jboss-server-migration +18 1.0.3-6.Final_redhat_6.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jbossws-cxf 5.1.10-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-narayana +10 5.5.31-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-10.SP9_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-resteasy +16 3.0.25-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-undertow 1.4.18-4.SP2_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-undertow-jastow 2.0.3-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly +1 7.1.1-4.GA_redhat_2.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.1.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.9-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-javadocs 7.1.1-3.GA_redhat_2.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wss4j +6 2.1.11-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-xml-security 2.0.9-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.infinispan:infinispan-core < 9.2.0.CR1 9.2.0.CR1 GHSA-46r5-59fg-2fjc

Advisories 5

References