CVE-2018-1131: Infinispan - Deserialization of Untrusted Data
Summary
CVE-2018-1131: Deserialization of Untrusted Data in Infinispan. Affects org.infinispan:infinispan-core versions >= 9.3.0.Alpha1, < 9.3.1.Final. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Infinispan is an open-source distributed caching and data grid platform written in Java. It provides a scalable and highly available data storage solution for applications. Infinispan allows users to store and retrieve data in a distributed manner, improving performance and reliability. It supports various data formats, including XML and JSON, for serialization and deserialization of objects.
Vulnerability Detail
The vulnerability in Infinispan arises from improper deserialization of untrusted data via XML and JSON transcoders. Under certain server configurations, an attacker with authenticated access to the server can send a malicious object to a cache that is configured to accept certain types of objects. This can lead to code execution and potential further attacks. The affected versions of Infinispan are 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, and 9.3.0.Alpha1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Infinispan.
Conclusion
Infinispan is susceptible to a deserialization vulnerability that allows an attacker to execute arbitrary code. It is crucial for users to upgrade to a patched version of Infinispan and review their deserialization configuration to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.infinispan:infinispan-core →
FAQ
Infinispan is an open-source distributed caching and data grid platform written in Java. It provides a scalable and highly available data storage solution for applications.
The vulnerability allows an attacker with authenticated access to the server to execute arbitrary code and potentially launch further attacks.
The affected versions of Infinispan are 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, and 9.3.0.Alpha1.
To fix this vulnerability, it is recommended to upgrade to version 9.3.1.Final of Infinispan or a later version. Users should update their Infinispan dependencies in their project's pom.xml file to the latest version.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Infinispan.
Related vulnerabilities
Recent vulnerabilities recorded for org.infinispan:infinispan-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
