Description
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=1576492
http://www.securityfocus.com/bid/104218
https://access.redhat.com/errata/RHSA-2018:1833
https://access.redhat.com/errata/RHSA-2019:3892
Related Vulnerabilities
CVE-2014-3681 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2020-28455 Vulnerability in npm package markdown-it-toc
CVE-2020-28479 Vulnerability in npm package jointjs
CVE-2021-21293 Vulnerability in maven package org.http4s:blaze-core_2.13
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-font