PT-2018-4626 · Red Hat · Infinispan

Chess Hazlett + 1 · Publicado 2018-09-11 · Atualizado 2021-04-07 · CVE-2016-0750

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Infinispan versions prior to 9.1.0.Final

Description The issue allows a malicious user to inject a specially-crafted serialized object, potentially leading to remote code execution or other attacks, due to the automatic deserialization of bytearray message contents in certain events by the hotrod java client.

Recommendations For versions prior to 9.1.0.Final, update to version 9.1.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the hotrod java client to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

CWE-138

Identificadores relacionados

CVE-2016-0750

OESA-2021-1139

Produtos afetados

Infinispan

Referências · 11

• https://github.com/infinispan/infinispan/pull/5116 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15089 · Nota de Segurança
• https://osv.dev/vulnerability/OESA-2021-1139 · Aviso do Fabricante
• https://issues.jboss.org/browse/ISPN-7781 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750 · Aviso do Fabricante
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1139 · Nota
• https://osv.dev/vulnerability/CVE-2016-0750 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3244 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0750 · Nota de Segurança
• http://securityfocus.com/bid/101910 · Nota
• https://access.redhat.com/errata/RHSA-2018:0501 · Aviso do Fabricante