PT-2025-4027 · Unknown+1 · Infinispan+1

Published 2025-01-23 · Updated 2025-11-01 · CVE-2025-0736

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Infinispan (affected versions not specified)

Description A flaw was found in Infinispan when using JGroups with JDBC PING, causing the exposure of sensitive information such as configuration details or credentials through logging mechanisms. This can lead to unauthorized access and exploitation by malicious actors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

ALT-PU-2025-13422

ALT-PU-2025-3710

BDU:2025-01357

CVE-2025-0736

GHSA-269M-C36J-R834

Affected Products

Alt Linux

Infinispan

References · 13

• https://access.redhat.com/errata/RHSA-2025:2663 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-269m-c36j-r834 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01357 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0736 · Security Note
• https://github.com/keycloak/keycloak/issues/36965 · Note
• https://github.com/infinispan/infinispan · Note
• https://twitter.com/CVEnew/status/1884183307178680559 · Twitter Post
• https://github.com/advisories/GHSA-269m-c36j-r834 · Note
• https://t.me/cvedetector/16594 · Telegram Post
• https://t.me/cvenotify/108851 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2025-0736 · Note
• https://t.me/cvenotify/114406 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2342233 · Note