PT-2018-4626 · Red Hat · Infinispan

Chess Hazlett + 1 · Published 2018-09-11 · Updated 2021-04-07 · CVE-2016-0750

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Infinispan versions prior to 9.1.0.Final

Description The issue allows a malicious user to inject a specially-crafted serialized object, potentially leading to remote code execution or other attacks, due to the automatic deserialization of bytearray message contents in certain events by the hotrod java client.

Recommendations For versions prior to 9.1.0.Final, update to version 9.1.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the hotrod java client to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-138

Related Identifiers

CVE-2016-0750

OESA-2021-1139

Affected Products

Infinispan

References · 11

• https://github.com/infinispan/infinispan/pull/5116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15089 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1139 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0750 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0750 · Security Note
• https://access.redhat.com/errata/RHSA-2018:0501 · Vendor Advisory
• https://issues.jboss.org/browse/ISPN-7781 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1139 · Note
• http://securityfocus.com/bid/101910 · Note