Description

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

Remediation

References

http://www.securityfocus.com/bid/101910

https://access.redhat.com/errata/RHSA-2017:3244

https://access.redhat.com/errata/RHSA-2018:0501

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750

https://github.com/infinispan/infinispan/pull/5116

https://issues.jboss.org/browse/ISPN-7781

Related Vulnerabilities

CVE-2022-2216 Vulnerability in npm package parse-url

CVE-2019-1010266 Vulnerability in maven package org.webjars.bowergithub.lodash:lodash

CVE-2019-1003085 Vulnerability in maven package org.jenkins-ci.plugins:zephyr-enterprise-test-management

CVE-2021-27884 Vulnerability in npm package yapi-vendor

CVE-2020-7765 Vulnerability in npm package @firebase/util

Severity

Critical

Classification

CWE-502 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory Issue Tracking Patch