Vulnerabilities > CVE-2016-0750 - Deserialization of Untrusted Data vulnerability in Infinispan

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

infinispan

CWE-502

NVD

Published: 2018-09-11

Updated: 2024-11-21

Summary

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

Vulnerable Configurations

Part	Description	Count
Application	Infinispan Infinispan Infinispan - Infinispan Infinispan 4.0.0 Infinispan Infinispan 4.1.0 Infinispan Infinispan 4.2.0 Infinispan Infinispan 4.2.1 Infinispan Infinispan 5.0.0 Infinispan Infinispan 5.0.1 Infinispan Infinispan 5.1.0 Infinispan Infinispan 5.1.1 Infinispan Infinispan 5.1.2 Infinispan Infinispan 5.1.3 Infinispan Infinispan 5.1.4 Infinispan Infinispan 5.1.5 Infinispan Infinispan 5.1.6 Infinispan Infinispan 5.1.7 Infinispan Infinispan 5.1.8 Infinispan Infinispan 5.2.0 Infinispan Infinispan 5.2.1 Infinispan Infinispan 5.2.2 Infinispan Infinispan 5.2.3 Infinispan Infinispan 5.2.4 Infinispan Infinispan 5.2.5 Infinispan Infinispan 5.2.6 Infinispan Infinispan 5.2.7 Infinispan Infinispan 5.2.8 Infinispan Infinispan 5.2.9 Infinispan Infinispan 5.2.10 Infinispan Infinispan 5.2.11 Infinispan Infinispan 5.2.12 Infinispan Infinispan 5.2.13 Infinispan Infinispan 5.2.14 Infinispan Infinispan 5.2.15 Infinispan Infinispan 5.2.16 Infinispan Infinispan 5.2.17 Infinispan Infinispan 5.2.18 Infinispan Infinispan 5.2.19 Infinispan Infinispan 5.2.20 Infinispan Infinispan 5.2.21 Infinispan Infinispan 5.2.22 Infinispan Infinispan 5.2.23 Infinispan Infinispan 5.3.0 Infinispan Infinispan 6.0.0 Infinispan Infinispan 6.0.1 Infinispan Infinispan 6.0.2 Infinispan Infinispan 7.0.0 Infinispan Infinispan 7.0.1 Infinispan Infinispan 7.0.2 Infinispan Infinispan 7.0.3 Infinispan Infinispan 7.1.0 Infinispan Infinispan 7.1.1 Infinispan Infinispan 7.2.0 Infinispan Infinispan 7.2.1 Infinispan Infinispan 7.2.2 Infinispan Infinispan 7.2.3 Infinispan Infinispan 7.2.4 Infinispan Infinispan 7.2.5 Infinispan Infinispan 8.0.0 Infinispan Infinispan 8.0.1 Infinispan Infinispan 8.0.2 Infinispan Infinispan 8.1.0 Infinispan Infinispan 8.1.1 Infinispan Infinispan 8.1.2 Infinispan Infinispan 8.1.3 Infinispan Infinispan 8.1.4 Infinispan Infinispan 8.1.5 Infinispan Infinispan 8.1.6 Infinispan Infinispan 8.1.7 Infinispan Infinispan 8.1.8 Infinispan Infinispan 8.1.9 Infinispan Infinispan 8.2.0 Infinispan Infinispan 8.2.1 Infinispan Infinispan 8.2.2 Infinispan Infinispan 8.2.3 Infinispan Infinispan 8.2.4 Infinispan Infinispan 8.2.5 Infinispan Infinispan 8.2.6 Infinispan Infinispan 8.2.7 Infinispan Infinispan 8.2.8 Infinispan Infinispan 8.2.9 Infinispan Infinispan 8.2.10 Infinispan Infinispan 8.2.11 Infinispan Infinispan 8.2.12 Infinispan Infinispan 9.0.0 Infinispan Infinispan 9.0.1 Infinispan Infinispan 9.0.2 Infinispan Infinispan 9.0.3	133

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Redhat

advisories

rhsa
id RHSA-2017:3244
rhsa
id RHSA-2018:0501

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Redhat

References