CVE-2016-0750: Infinispan Core Vulnerability Leading to Remote Code Execution
Summary
CVE-2016-0750: The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. Affects org.infinispan:infinispan-core versions < 9.1.0.Final. Fixed in 9.1.0.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Infinispan is a distributed in-memory key/value data store and cache, designed for high-performance applications. It provides features such as data partitioning, replication, and querying capabilities. The Hot Rod Java client allows applications to interact with Infinispan servers. However, prior to version 9.1.0.Final, the client had a significant security flaw that allowed for automatic deserialization of untrusted byte-array data, making it susceptible to attacks.
Vulnerability Detail
The vulnerability arises from the Hot Rod Java client in Infinispan versions before 9.1.0.Final, which automatically deserializes byte-array message contents during certain operations. This behavior can be exploited by a malicious user who injects a specially-crafted serialized object, potentially leading to remote code execution or other malicious activities. The flaw is classified under CWE-502, indicating a risk associated with deserialization of untrusted data.
How To Fix
Minimum fixed version
9.1.0.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling automatic deserialization in the Hot Rod client configuration, or implement strict validation of incoming data to mitigate the risk of exploitation.
Conclusion
The CVE-2016-0750 vulnerability in the Infinispan Hot Rod Java client poses a significant risk due to its potential for remote code execution. It is crucial for users of affected versions to update to 9.1.0.Final or later to mitigate this risk. For those unable to upgrade immediately, implementing workarounds can help reduce exposure.
See every vulnerability recorded for org.infinispan:infinispan-core →
FAQ
CVE-2016-0750 is a vulnerability in the Infinispan Hot Rod Java client that allows for the deserialization of untrusted data, potentially leading to remote code execution.
Versions of Infinispan prior to 9.1.0.Final are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot upgrade, consider disabling automatic deserialization or implementing strict validation of incoming data as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for org.infinispan:infinispan-core.
