CVE-2017-15089
infinispan: Unsafe deserialization of malicious object injected into data cache
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Se ha descubierto que el cliente Hotrod en Infinispan, en versiones anteriores a la 9.2.0.CR1 lee de forma insegura los datos deserializados en la información de la caché. Un atacante autenticado podría inyectar un objeto malicioso en la caché de datos y lograr la deserialización en el cliente, además de llevar a cabo ataques a mayores.
It was found that the Hotrod client in Infinispan would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-10-08 CVE Reserved
- 2018-02-12 CVE Published
- 2023-09-11 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id/1040360 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/infinispan/infinispan/pull/5639 | 2019-06-04 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2018:0294 | 2019-06-04 | |
| https://access.redhat.com/errata/RHSA-2018:0478 | 2019-06-04 | |
| https://access.redhat.com/errata/RHSA-2018:0479 | 2019-06-04 | |
| https://access.redhat.com/errata/RHSA-2018:0480 | 2019-06-04 | |
| https://access.redhat.com/errata/RHSA-2018:0481 | 2019-06-04 | |
| https://access.redhat.com/errata/RHSA-2018:0501 | 2019-06-04 | |
| https://access.redhat.com/errata/RHSA-2019:1326 | 2019-06-04 | |
| https://access.redhat.com/security/cve/CVE-2017-15089 | 2020-06-15 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1503610 | 2020-06-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Infinispan Search vendor "Infinispan" | Infinispan Search vendor "Infinispan" for product "Infinispan" | <= 9.1.6 Search vendor "Infinispan" for product "Infinispan" and version " <= 9.1.6" | - |
Affected
| ||||||
| Infinispan Search vendor "Infinispan" | Infinispan Search vendor "Infinispan" for product "Infinispan" | 9.2.0 Search vendor "Infinispan" for product "Infinispan" and version "9.2.0" | alpha1 |
Affected
| ||||||
| Infinispan Search vendor "Infinispan" | Infinispan Search vendor "Infinispan" for product "Infinispan" | 9.2.0 Search vendor "Infinispan" for product "Infinispan" and version "9.2.0" | alpha2 |
Affected
| ||||||
| Infinispan Search vendor "Infinispan" | Infinispan Search vendor "Infinispan" for product "Infinispan" | 9.2.0 Search vendor "Infinispan" for product "Infinispan" and version "9.2.0" | beta1 |
Affected
| ||||||
| Infinispan Search vendor "Infinispan" | Infinispan Search vendor "Infinispan" for product "Infinispan" | 9.2.0 Search vendor "Infinispan" for product "Infinispan" and version "9.2.0" | beta2 |
Affected
| ||||||
| Infinispan Search vendor "Infinispan" | Infinispan Search vendor "Infinispan" for product "Infinispan" | 9.2.0 Search vendor "Infinispan" for product "Infinispan" and version "9.2.0" | cr1 |
Affected
| ||||||