Lucene search
PRIOn knowledge basePRION:CVE-2017-15089HistoryFeb 15, 2018 - 5:29 p.m.
Deserialization of untrusted data
2018-02-1517:29:00
PRIOn knowledge base
www.prio-n.com
8
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| infinispan | eq | 9.2.0 cr1 | |
| infinispan | eq | 9.2.0 beta2 | |
| infinispan | eq | 9.2.0 beta1 | |
| infinispan | eq | 9.2.0 alpha2 | |
| infinispan | eq | 9.2.0 alpha1 | |
| infinispan | le | 9.1.6 |
References
www.securitytracker.com/id/1040360
access.redhat.com/errata/RHSA-2018:0294
access.redhat.com/errata/RHSA-2018:0478
access.redhat.com/errata/RHSA-2018:0479
access.redhat.com/errata/RHSA-2018:0480
access.redhat.com/errata/RHSA-2018:0481
access.redhat.com/errata/RHSA-2018:0501
access.redhat.com/errata/RHSA-2019:1326
github.com/infinispan/infinispan/pull/5639
Related
osv
osv
CVE-2017-15089
2018-02-15 17:29:00
Deserialization of Untrusted Data in Infinispan
2022-05-14 00:59:30
cvelist
cvelist
CVE-2017-15089
2018-02-12 00:00:00
nvd
nvd
CVE-2017-15089
2018-02-15 17:29:00
checkpoint_advisories
checkpoint_advisories
veracode
veracode
Unsafe Deserialization
2018-02-16 04:26:56
github
github
Deserialization of Untrusted Data in Infinispan
2022-05-14 00:59:30
cve
cve
CVE-2017-15089
2018-02-15 17:29:00
redhatcve
redhatcve
CVE-2017-15089
2019-10-22 06:42:42
redhat
redhat
nessus
nessus
RHEL 8 : infinispan (Unpatched Vulnerability)
2024-05-11 00:00:00