CVE-2017-15089

Description (CNA)

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

Affected (CNA)

CWE

CWE-502

References

• http://www.securitytracker.com/id/1040360
• https://access.redhat.com/errata/RHSA-2018:0479
• https://access.redhat.com/errata/RHSA-2018:0481
• https://github.com/infinispan/infinispan/pull/5639
• https://access.redhat.com/errata/RHSA-2018:0294
• https://access.redhat.com/errata/RHSA-2018:0501
• https://access.redhat.com/errata/RHSA-2018:0480
• https://access.redhat.com/errata/RHSA-2018:0478
• https://access.redhat.com/errata/RHSA-2019:1326

ADP enrichment