CVE-2019-10174: Infinispan - Use of Externally-Controlled Input to Select Classes or Code
Summary
CVE-2019-10174: Use of Externally-Controlled Input to Select Classes or Code in Infinispan. Affects org.infinispan:infinispan-core across 2 version ranges.
< 8.2.12.Final
>= 9.0.0.Final, < 9.4.17.Final
Fixed in 8.2.12.Final or 9.4.17.Final, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Infinispan is an open-source data grid platform that provides distributed caching and in-memory data storage capabilities. It is widely used in Java applications to improve performance and scalability. Infinispan allows applications to store and retrieve data in a distributed manner, making it suitable for use cases such as caching, clustering, and data replication. However, a vulnerability has been discovered in Infinispan that allows an attacker to invoke private methods in any class with Infinispan's privileges, potentially introducing malicious behavior into the application.
Vulnerability Detail
The vulnerability (CVE-2019-10174) resides in the ReflectionUtil class of Infinispan, specifically in the invokeAccessibly method. This method allows any application class to invoke private methods in any class with Infinispan's privileges. By using reflection, an attacker can exploit this vulnerability to introduce new, malicious behavior into the application. This can lead to various security risks, including unauthorized access, data manipulation, and remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.2.12.Final8.2.12.Final -
>= 9.0.0.Final, < 9.4.17.Final9.4.17.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed versions mentioned above.
Conclusion
Infinispan, an open-source data grid platform widely used in Java applications, is vulnerable to a critical security flaw (CVE-2019-10174). This vulnerability allows an attacker to invoke private methods in any class with Infinispan's privileges, potentially leading to unauthorized access, data manipulation, and remote code execution. To mitigate this risk, it is crucial to upgrade to the fixed versions of Infinispan mentioned above. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.infinispan:infinispan-core →
FAQ
Infinispan is an open-source data grid platform that provides distributed caching and in-memory data storage capabilities. It is widely used in Java applications to improve performance and scalability.
This vulnerability allows an attacker to invoke private methods in any class with Infinispan's privileges, potentially introducing malicious behavior into the application. This can lead to unauthorized access, data manipulation, and remote code execution.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Infinispan. For versions 8.2.x, upgrade to version 8.2.12.Final or later. For versions 9.0.x to 9.4.x, upgrade to version 9.4.17.Final or later.
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed versions mentioned above.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the vulnerability details]
References
Related vulnerabilities
Recent vulnerabilities recorded for org.infinispan:infinispan-core.
