PT-2018-10472 · Red Hat · Infinispan

Chess Hazlett · Publicado 2018-05-15 · Atualizado 2022-05-13 · CVE-2018-1131

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Infinispan versions 8.2.10.Final through 9.3.0.Alpha1

Description The issue allows for improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. An authenticated user could send a malicious object to a cache configured to accept specific types of objects, potentially achieving code execution and further attacks.

Recommendations For version 8.2.10.Final, update to a version that includes a fix for this issue. For version 9.0.3.Final, update to a version that includes a fix for this issue. For version 9.1.7.Final, update to a version that includes a fix for this issue. For version 9.2.2.Final, update to a version that includes a fix for this issue. For version 9.3.0.Alpha1, update to a version that includes a fix for this issue.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

CWE-349

Identificadores relacionados

CVE-2018-1131

GHSA-QQFC-M9HC-PQV3

Produtos afetados

Infinispan

Referências · 8

• https://github.com/infinispan/infinispan · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1131 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qqfc-m9hc-pqv3 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:1833 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1131 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:3892 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1576492 · Nota
• http://securityfocus.com/bid/104218 · Nota