PT-2020-9052 · Red Hat · Infinispan

The-Cartographer · Published 2020-01-02 · Updated 2023-12-27 · CVE-2019-10158

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Infinispan versions prior to 9.4.14.Final

Description A flaw was found in the improper implementation of the session fixation protection in the Spring Session integration, which can result in incorrect session handling.

Recommendations For versions prior to 9.4.14.Final, update to version 9.4.14.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the Spring Session integration until a patch is available.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2019-10158

GHSA-6X3V-RW2Q-9GX7

Affected Products

Infinispan

References · 12

• https://osv.dev/vulnerability/GHSA-6x3v-rw2q-9gx7 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-10158 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10158 · Vendor Advisory
• https://github.com/infinispan/infinispan · Note
• https://github.com/infinispan/infinispan/pull/7025 · Note
• https://github.com/infinispan/infinispan/commits/9.4.15.Final · Note
• https://github.com/infinispan/infinispan/pull/7043 · Note
• https://github.com/infinispan/infinispan/commit/4b381c5910265972ccaabefbdbd16a2b929f6b72 · Note
• https://github.com/infinispan/infinispan/pull/6960 · Note
• https://t.me/cvenotify/65207 · Telegram Post
• https://security.netapp.com/advisory/ntap-20231227-0009 · Note