PT-2023-31964 · Unknown · Infinispan

Chess Hazlett · Publicado 2023-12-18 · Atualizado 2025-09-25 · CVE-2023-5236

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Infinispan (affected versions not specified)

Description A flaw was found in the software, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-1047

Identificadores relacionados

CVE-2023-5236

GHSA-488M-W9FP-5MM2

Produtos afetados

Infinispan

Referências · 18

• https://github.com/infinispan/infinispan · Nota
• https://github.com/infinispan/protostream/commit/4501b6b307a6bab545346f66238f8be7e42f83eb · Nota
• https://github.com/infinispan/protostream/commit/4ef66958f2c4890ae1c6a7acd629d27bd88aa4cb · Nota
• https://github.com/infinispan/protostream/commit/50320b5987dc87bc04b616b87e8cf93472ee19c1 · Nota
• https://access.redhat.com/errata/RHSA-2023:5396 · Aviso do Fabricante
• https://t.me/cveNotify/136370 · Publicação no Telegram
• https://access.redhat.com/security/cve/CVE-2023-5236 · Aviso do Fabricante
• https://issues.redhat.com/browse/IPROTO-262 · Nota
• https://osv.dev/vulnerability/CVE-2023-5236 · Aviso do Fabricante
• https://issues.redhat.com/browse/IPROTO-263 · Nota
• https://t.me/cvenotify/68662 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20240125-0004 · Nota
• https://issues.redhat.com/browse/ISPN-14534 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2240999 · Nota
• https://t.me/cvenotify/65520 · Publicação no Telegram