Skip to content
OpenAdvisories
High · 7.2 CVE-2023-5384 EUVD-2023-3210GHSA-gg57-587f-h5v6

Infinispan: credentials returned from configuration as clear text

Published Dec 18, 2023 · Updated Nov 20, 2025 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Data Grid 8.4.6 Package: org.infinispan:infinispan-cachestore-jdbc Package: org.infinispan:infinispan-cachestore-jdbc-common Package: org.infinispan:infinispan-cachestore-remote Package: org.infinispan:infinispan-cachestore-sql Package: org.infinispan:infinispan-client-hotrod Package: org.infinispan:infinispan-commons Package: org.infinispan:infinispan-core Package: org.infinispan:infinispan-hotrod Ecosystem: Maven

Description

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Data Grid 8.4.6 — —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.infinispan:infinispan-cachestore-jdbc >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-cachestore-jdbc < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-cachestore-jdbc-common >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-cachestore-jdbc-common < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-cachestore-remote >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-cachestore-remote < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-cachestore-sql >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-cachestore-sql < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-client-hotrod >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-client-hotrod < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-commons >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-commons < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-core >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-core < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-hotrod >= 15.0.0.Dev01, < 15.0.0.Dev07 15.0.0.Dev07 GHSA-gg57-587f-h5v6
Maven org.infinispan:infinispan-hotrod < 14.0.25.Final 14.0.25.Final GHSA-gg57-587f-h5v6

Advisories 2

References