CVE-2017-15089

HIGH

Infinispan < 9.1.6 and < 9.2.0.CR1 - Authenticated Deserialization of Untrusted Data via Hotrod Client

Title source: llm
STIX 2.1

Description

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040360
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0479
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0481
Patch, Third Party Advisory x_refsource_confirm
https://github.com/infinispan/infinispan/pull/5639
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0294
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0501
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0480
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0478
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1326

Scores

CVSS v3 8.8
EPSS 0.0288
EPSS Percentile 85.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (3)
infinispan/infinispan 9.2.0 alpha1 (5 CPE variants)
infinispan/infinispan < 9.1.6
org.infinispan/infinispan-core 0 - 9.2.0.CR1Maven
Published Feb 15, 2018
Tracked Since Feb 18, 2026