Description
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Remediation
References
https://github.com/infinispan/infinispan/pull/5639
https://access.redhat.com/errata/RHSA-2018:0294
http://www.securitytracker.com/id/1040360
https://access.redhat.com/errata/RHSA-2018:0481
https://access.redhat.com/errata/RHSA-2018:0480
https://access.redhat.com/errata/RHSA-2018:0479
https://access.redhat.com/errata/RHSA-2018:0478
https://access.redhat.com/errata/RHSA-2018:0501
https://access.redhat.com/errata/RHSA-2019:1326
Related Vulnerabilities
CVE-2020-35217 Vulnerability in maven package io.vertx:vertx-web
CVE-2021-21364 Vulnerability in maven package io.swagger:swagger-codegen
CVE-2023-37945 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp
CVE-2021-3856 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2023-36542 Vulnerability in maven package org.apache.nifi:nifi-record-serialization-services