It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Infinispan | Infinispan | * | 9.1.6 (including) |
| Infinispan | Infinispan | 9.2.0-alpha1 (including) | 9.2.0-alpha1 (including) |
| Infinispan | Infinispan | 9.2.0-alpha2 (including) | 9.2.0-alpha2 (including) |
| Infinispan | Infinispan | 9.2.0-beta1 (including) | 9.2.0-beta1 (including) |
| Infinispan | Infinispan | 9.2.0-beta2 (including) | 9.2.0-beta2 (including) |
| Infinispan | Infinispan | 9.2.0-cr1 (including) | 9.2.0-cr1 (including) |
| Red Hat Data Grid 7.1.2 | RedHat | infinispan-core | * |
| Red Hat Fuse 6.3 | RedHat | Camel | * |
| Red Hat JBoss EAP 7 | RedHat | infinispan-core | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-infinispan-0:8.2.9-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-ironjacamar-0:1.4.7-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jackson-annotations-0:2.8.11-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jackson-core-0:2.8.11-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jackson-databind-0:2.8.11-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jackson-jaxrs-providers-0:2.8.11-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jackson-module-jaxb-annotations-0:2.8.11-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jackson-modules-java8-0:2.8.11-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jboss-logmanager-0:2.0.8-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jboss-server-migration-0:1.0.3-6.Final_redhat_6.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jbossws-cxf-0:5.1.10-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-narayana-0:5.5.31-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-picketlink-bindings-0:2.5.5-10.SP9_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-picketlink-federation-0:2.5.5-10.SP9_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-resteasy-0:3.0.25-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-undertow-0:1.4.18-4.SP2_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-undertow-jastow-0:2.0.3-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-wildfly-0:7.1.1-4.GA_redhat_2.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-wildfly-elytron-0:1.1.8-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-wildfly-http-client-0:1.0.9-1.Final_redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-wildfly-javadocs-0:7.1.1-3.GA_redhat_2.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-wss4j-0:2.1.11-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-xml-security-0:2.0.9-1.redhat_1.1.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | RedHat | eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el6 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-infinispan-0:8.2.9-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-ironjacamar-0:1.4.7-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jackson-annotations-0:2.8.11-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jackson-core-0:2.8.11-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jackson-databind-0:2.8.11-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jackson-jaxrs-providers-0:2.8.11-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jackson-module-jaxb-annotations-0:2.8.11-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jackson-modules-java8-0:2.8.11-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jboss-logmanager-0:2.0.8-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jboss-server-migration-0:1.0.3-6.Final_redhat_6.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jbossws-cxf-0:5.1.10-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-narayana-0:5.5.31-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-picketlink-bindings-0:2.5.5-10.SP9_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-picketlink-federation-0:2.5.5-10.SP9_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-resteasy-0:3.0.25-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-undertow-0:1.4.18-4.SP2_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-undertow-jastow-0:2.0.3-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-wildfly-0:7.1.1-4.GA_redhat_2.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-wildfly-elytron-0:1.1.8-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-wildfly-http-client-0:1.0.9-1.Final_redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-wildfly-javadocs-0:7.1.1-3.GA_redhat_2.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-wss4j-0:2.1.11-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-xml-security-0:2.0.9-1.redhat_1.1.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | RedHat | eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el7 | * |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | RedHat | infinispan-core | * |
| Red Hat Single Sign-On 7.2.1 zip | RedHat | * |