PT-2018-5755 · Red Hat · Infinispan
Shrimpsha
·
Published
2018-02-15
·
Updated
2022-05-14
·
CVE-2017-15089
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Infinispan versions prior to 9.2.0.CR1
Description:
The issue allows an authenticated attacker to inject a malicious object into the data cache, potentially leading to deserialization on the client and further attacks. This occurs because the Hotrod client in Infinispan unsafely reads deserialized data from the cache.
Recommendations:
For versions prior to 9.2.0.CR1, update to version 9.2.0.CR1 or later to resolve the issue. As a temporary workaround, consider restricting access to the cache to minimize the risk of exploitation.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Infinispan