Deserialization of Untrusted Data in Infinispan
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-15089US | high8.8 | — | ||
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a mal… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2018:0294WEB
- https://access.redhat.com/errata/RHSA-2018:0478WEB
- https://access.redhat.com/errata/RHSA-2018:0479WEB
- https://access.redhat.com/errata/RHSA-2018:0480WEB
- https://access.redhat.com/errata/RHSA-2018:0481WEB
- https://access.redhat.com/errata/RHSA-2018:0501WEB
- https://access.redhat.com/errata/RHSA-2019:1326WEB
- https://github.com/infinispan/infinispanPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan