Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2016-0750 · ADVISORY
• infinispan/infinispan#5116 · WEB
• access.redhat.com/errata/RHSA-2017:3244 · WEB
• access.redhat.com/errata/RHSA-2018:0501 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• infinispan/infinispan · PACKAGE
• issues.jboss.org/browse/ISPN-7781 · WEB
• securityfocus.com/bid/101910 · WEB

org.infinispan:infinispan-core のその他の脆弱性

• CVE-2023-5384低 2.7A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with…
• CVE-2020-25711中 6.5A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operatio…
• CVE-2019-10158緊急 9.8A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Ses…
• CVE-2019-10174高 8.8A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application cl…
• CVE-2018-1131高 8.8Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with au…