Description
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | infinispan | 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.infinispan:infinispan-core | 8.2.10.Final | — | GHSA-qqfc-m9hc-pqv3 |
| Maven | org.infinispan:infinispan-core | 9.0.3.Final | — | GHSA-qqfc-m9hc-pqv3 |
| Maven | org.infinispan:infinispan-core | 9.1.7.Final | — | GHSA-qqfc-m9hc-pqv3 |
| Maven | org.infinispan:infinispan-core | 9.2.2.Final | — | GHSA-qqfc-m9hc-pqv3 |
| Maven | org.infinispan:infinispan-core | >= 9.3.0.Alpha1, < 9.3.1.Final | 9.3.1.Final | GHSA-qqfc-m9hc-pqv3 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1576492
- 104218 vdb-entry
- RHSA-2018:1833 vendor-advisory
- RHSA-2019:3892 vendor-advisory