| Package | Affected versions | Patched versions |
|---|---|---|
| org.infinispan:infinispan-cachestore-jdbc | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| org.infinispan:infinispan-cachestore-jdbc-common | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| org.infinispan:infinispan-cachestore-remote | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| org.infinispan:infinispan-cachestore-sql | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| org.infinispan:infinispan-client-hotrod | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| org.infinispan:infinispan-commons | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| org.infinispan:infinispan-core | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| org.infinispan:infinispan-hotrod | ≥ 15.0.0.Dev01, < 15.0.0.Dev07< 14.0.25.Final | 15.0.0.Dev0714.0.25.Final |
| data grid | < 8.4.6 | 8.4.6 |
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free