CVE-2017-15089
N/A
N/A
Summary
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Infinispan | infinispan | before 9.2.0.CR1 | affected |
Weaknesses
- CWE-502: CWE-502
ADP Enrichment
CVE Program Container
Additional References
- http://www.securitytracker.com/id/1040360
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0481
- https://github.com/infinispan/infinispan/pull/5639
- https://access.redhat.com/errata/RHSA-2018:0294
- https://access.redhat.com/errata/RHSA-2018:0501
- https://access.redhat.com/errata/RHSA-2018:0480
- https://access.redhat.com/errata/RHSA-2018:0478
- https://access.redhat.com/errata/RHSA-2019:1326
References
- http://www.securitytracker.com/id/1040360
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0481
- https://github.com/infinispan/infinispan/pull/5639
- https://access.redhat.com/errata/RHSA-2018:0294
- https://access.redhat.com/errata/RHSA-2018:0501
- https://access.redhat.com/errata/RHSA-2018:0480
- https://access.redhat.com/errata/RHSA-2018:0478
- https://access.redhat.com/errata/RHSA-2019:1326
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.