CVE-2023-5384: Infinispan Credential Exposure in Configuration Files
Summary
CVE-2023-5384: Infinispan caches credentials in clear text. Affects org.infinispan:infinispan-core across 2 version ranges.
< 14.0.25.Final
>= 15.0.0.Dev01, < 15.0.0.Dev07
Fixed in 14.0.25.Final or 15.0.0.Dev07, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Infinispan is a distributed in-memory key/value data store and cache, designed for high performance and scalability. It is widely used in Java applications for caching and data storage. The package provides various features such as data partitioning, replication, and persistence. However, a significant vulnerability has been identified that exposes sensitive credentials in clear text when configurations are serialized to XML, JSON, or YAML formats.
Vulnerability Detail
A flaw exists in Infinispan where credentials, particularly those related to JDBC stores with connection pooling and remote stores, are serialized in clear text during the configuration process. This vulnerability arises from inadequate handling of sensitive information, allowing attackers to potentially access these credentials if the configuration files are exposed. The ramifications include unauthorized access to databases and other services that rely on these credentials, leading to data breaches and compromised systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 14.0.25.Final14.0.25.Final -
>= 15.0.0.Dev01, < 15.0.0.Dev0715.0.0.Dev07
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid including sensitive credentials in configuration files. Instead, consider using environment variables or secure vaults to manage sensitive information. This can be achieved by modifying your application to read credentials from a secure source rather than hardcoding them in configuration files.
Conclusion
The vulnerability CVE-2023-5384 in Infinispan poses a significant risk by exposing sensitive credentials in clear text. Users are advised to upgrade to the latest versions to mitigate this risk. In the meantime, implementing workarounds can help secure sensitive information until an upgrade can be performed.
See every vulnerability recorded for org.infinispan:infinispan-core →
FAQ
CVE-2023-5384 is a vulnerability in Infinispan that exposes sensitive credentials in clear text when configuration files are serialized.
Versions prior to 15.0.0.Dev07 and 14.0.25.Final are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check your application without needing to sign up.
The risks include unauthorized access to databases and services, leading to data breaches and compromised systems.
If an immediate upgrade is not possible, implement workarounds such as using environment variables or secure vaults to manage sensitive credentials.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.infinispan:infinispan-core.
