Description
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Data Grid 8.4.4 | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | — | — |
| Red Hat | Red Hat build of Debezium 2 | — | — |
| Red Hat | Red Hat build of Debezium 3 | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.infinispan.protostream:protostream | < 4.6.2.Final | 4.6.2.Final | GHSA-488m-w9fp-5mm2 |
Advisories 2
- WID-SEC-2024-3694 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 12, 2024
- WID-SEC-2023-2518 Red Hat JBoss Data Grid: Mehre Schwachstellen BSI CERT-Bund (WID) · Jul 1, 2024
References
- RHSA-2023:5396 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-5236 vdb-entry
- RHBZ#2240999 issue-tracking