CVE-2017-15089: Deserialization of Untrusted Data in Infinispan
Summary
CVE-2017-15089: Deserialization of Untrusted Data in Infinispan. Affects org.infinispan:infinispan-core versions < 9.2.0.CR1. Fixed in 9.2.0.CR1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Infinispan is an open-source, distributed in-memory key/value data store and cache designed for fast and scalable data access. It provides advanced caching features and can be used as a standalone cache or integrated into various applications. Infinispan is widely used in enterprise environments to improve performance and scalability of data-intensive applications.
Vulnerability Detail
The Hotrod client in Infinispan before version 9.2.0.CR1 is vulnerable to deserialization of untrusted data. This vulnerability allows an authenticated attacker to inject a malicious object into the data cache and exploit it during deserialization on the client side. By leveraging this vulnerability, an attacker can potentially execute arbitrary code or conduct further attacks on the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
9.2.0.CR1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the recommended fix by upgrading to the latest version of Infinispan.
Conclusion
Infinispan before version 9.2.0.CR1 is vulnerable to deserialization of untrusted data, which can lead to arbitrary code execution or further attacks. It is crucial to upgrade to the latest version of Infinispan to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.infinispan:infinispan-core →
FAQ
Infinispan is an open-source, distributed in-memory key/value data store and cache designed for fast and scalable data access. It provides advanced caching features and can be used as a standalone cache or integrated into various applications.
This vulnerability allows an authenticated attacker to inject a malicious object into the data cache and exploit it during deserialization on the client side. By leveraging this vulnerability, an attacker can potentially execute arbitrary code or conduct further attacks on the affected system.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to Infinispan version 9.2.0.CR1 or later. This version includes a fix for the deserialization issue and ensures that untrusted data is not deserialized unsafely.
There is no known workaround for this vulnerability. It is strongly advised to apply the recommended fix by upgrading to the latest version of Infinispan.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.infinispan:infinispan-core.
