Description
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | infinispan | < 15.2.5 | 15.2.5 |
| Red Hat | Red Hat Data Grid 8.5.4 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | infinispan-16.1 | 16.1.0-r0 | — |
| Wolfi rolling | infinispan-16.3 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.infinispan:infinispan-cli-client | <= 16.0.0.Dev01 | — | GHSA-cqm8-rg2p-jfcf |
Advisories 1
- WID-SEC-2025-1446 Red Hat JBoss Data Grid: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 1, 2025
References
- RHSA-2025:10130 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-5731 vdb-entry
- RHBZ#2370429 issue-tracking