CVE-2016-0750 Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization
HighCVSS 8.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-core(Maven) | < 9.1.0.Final | 9.1.0.Final |
| org.infinispan/infinispan-core(Maven) | = 5.0.0.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.0.1.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.1.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.1.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.2.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.2.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.3.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.3.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.4.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.4.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.5.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.5.FINAL | No fix listed |
Show 140 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-core(Maven) | = 5.1.6.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta6 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.10.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.11.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.12.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.13.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.14.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.15.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.18.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.19.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.20.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.7-wolfc-1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.8.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.9.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.9.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.10.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.12.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.CR1 | No fix listed |
| infinispan | < 9.1.0 | 9.1.0 |
| redhat infinispan | = 9.1.0.Final | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch vendor-advisory
- RHSA-2017:3244 vendor-advisory
- RHSA-2018:0501 vendor-advisory
- bugzilla.redhat.com issue-tracking vendor-advisory
- github.com product
- issues.jboss.org issue-tracking third-party-advisory
- 101910 third-party-advisory vdb-entry
- github.com