CVE-2017-15089 Deserialization of Untrusted Data in Infinispan
HighCVSS 8.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-core(Maven) | <= 9.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | < 9.2.0.CR1 | 9.2.0.CR1 |
| org.infinispan/infinispan-core(Maven) | = 5.0.0.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.0.1.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.1.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.1.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.2.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.2.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.3.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.3.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.4.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.4.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.5.CR1 | No fix listed |
Show 158 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-core(Maven) | = 5.1.5.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.6.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta6 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.10.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.11.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.12.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.13.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.14.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.15.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.18.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.19.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.20.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.7-wolfc-1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.8.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.9.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.9.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.10.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.12.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.CR4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Beta2 | No fix listed |
| infinispan | <= 9.1.6 | No fix listed |
| infinispan | = 9.2.0-alpha1 | No fix listed |
| infinispan | = 9.2.0-alpha2 | No fix listed |
| infinispan | = 9.2.0-beta1 | No fix listed |
| infinispan | = 9.2.0-beta2 | No fix listed |
| infinispan | = 9.2.0-cr1 | No fix listed |
| infinispan | = before 9.2.0.CR1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- RHSA-2018:0294 third-party-advisory vendor-advisory
- RHSA-2018:0478 vendor-advisory
- RHSA-2018:0479 vendor-advisory
- RHSA-2018:0480 vendor-advisory
- RHSA-2018:0481 vendor-advisory
- RHSA-2018:0501 vendor-advisory
- RHSA-2019:1326 vendor-advisory
- github.com patch
- github.com patch
- github.com
- github.com product
- 1040360 third-party-advisory vdb-entry