Vulnerability-Lookup

CVE-2017-15089 (GCVE-0-2017-15089)

Vulnerability from cvelistv5 – Published: 2018-02-15 17:00 – Updated: 2024-09-16 19:05

Summary

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-502

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1081 records in the last 180 days details

References

9 references

URL	Tags
http://www.securitytracker.com/id/1040360	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2018:0479	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:0481	vendor-advisoryx_refsource_REDHAT
https://github.com/infinispan/infinispan/pull/5639	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:0294	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:0501	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:0480	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:0478	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1326	vendor-advisoryx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version	CPE status
Infinispan	infinispan	Affected: before 9.2.0.CR1	guessed

Date Public

2018-02-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:50:14.965Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1040360",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040360"
          },
          {
            "name": "RHSA-2018:0479",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0479"
          },
          {
            "name": "RHSA-2018:0481",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0481"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/infinispan/infinispan/pull/5639"
          },
          {
            "name": "RHSA-2018:0294",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0294"
          },
          {
            "name": "RHSA-2018:0501",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0501"
          },
          {
            "name": "RHSA-2018:0480",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0480"
          },
          {
            "name": "RHSA-2018:0478",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0478"
          },
          {
            "name": "RHSA-2019:1326",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1326"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "infinispan",
          "vendor": "Infinispan",
          "versions": [
            {
              "status": "affected",
              "version": "before 9.2.0.CR1"
            }
          ]
        }
      ],
      "datePublic": "2018-02-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-04T16:06:03.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "1040360",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040360"
        },
        {
          "name": "RHSA-2018:0479",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0479"
        },
        {
          "name": "RHSA-2018:0481",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0481"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/infinispan/infinispan/pull/5639"
        },
        {
          "name": "RHSA-2018:0294",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0294"
        },
        {
          "name": "RHSA-2018:0501",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0501"
        },
        {
          "name": "RHSA-2018:0480",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0480"
        },
        {
          "name": "RHSA-2018:0478",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0478"
        },
        {
          "name": "RHSA-2019:1326",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1326"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2018-02-12T00:00:00",
          "ID": "CVE-2017-15089",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "infinispan",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 9.2.0.CR1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Infinispan"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1040360",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040360"
            },
            {
              "name": "RHSA-2018:0479",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0479"
            },
            {
              "name": "RHSA-2018:0481",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0481"
            },
            {
              "name": "https://github.com/infinispan/infinispan/pull/5639",
              "refsource": "CONFIRM",
              "url": "https://github.com/infinispan/infinispan/pull/5639"
            },
            {
              "name": "RHSA-2018:0294",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0294"
            },
            {
              "name": "RHSA-2018:0501",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0501"
            },
            {
              "name": "RHSA-2018:0480",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0480"
            },
            {
              "name": "RHSA-2018:0478",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0478"
            },
            {
              "name": "RHSA-2019:1326",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1326"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-15089",
    "datePublished": "2018-02-15T17:00:00.000Z",
    "dateReserved": "2017-10-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T19:05:25.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-15089",
      "date": "2026-11-02",
      "epss": "0.02827",
      "percentile": "0.86602"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "73C3E6FB-4EE2-4538-A190-3F680D9E7A3B",
                  "versionEndIncluding": "9.1.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha1:*:*:*:*:*:*",
                  "matchCriteriaId": "6A2B14A3-8FAE-4C32-9E1A-F32D49E1EFAE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha2:*:*:*:*:*:*",
                  "matchCriteriaId": "35E90E01-47E7-44CB-A617-385AB0E6CB9F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta1:*:*:*:*:*:*",
                  "matchCriteriaId": "FC00B1CC-C522-44FC-AB04-973D0E75C4E8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta2:*:*:*:*:*:*",
                  "matchCriteriaId": "7248C01A-3848-4E22-AC9D-9D0E9D31EE80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:cr1:*:*:*:*:*:*",
                  "matchCriteriaId": "3FDEC571-F826-4993-ABE3-3E94ECA684C5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."
        },
        {
          "lang": "es",
          "value": "Se ha descubierto que el cliente Hotrod en Infinispan, en versiones anteriores a la 9.2.0.CR1 lee de forma insegura los datos deserializados en la informaci\u00f3n de la cach\u00e9. Un atacante autenticado podr\u00eda inyectar un objeto malicioso en la cach\u00e9 de datos y lograr la deserializaci\u00f3n en el cliente, adem\u00e1s de llevar a cabo ataques a mayores."
        }
      ],
      "id": "CVE-2017-15089",
      "lastModified": "2024-11-21T03:14:02.923",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 6.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV30": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.0"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2018-02-15T17:29:00.207",
      "references": [
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securitytracker.com/id/1040360"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0294"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2018:0478"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2018:0479"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2018:0480"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2018:0481"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2018:0501"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHSA-2019:1326"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/infinispan/infinispan/pull/5639"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory",
            "VDB Entry"
          ],
          "url": "http://www.securitytracker.com/id/1040360"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0294"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2018:0478"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2018:0479"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2018:0480"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2018:0481"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2018:0501"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHSA-2019:1326"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/infinispan/infinispan/pull/5639"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ],
          "source": "secalert@redhat.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-502"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "73C3E6FB-4EE2-4538-A190-3F680D9E7A3B",
                    "versionEndIncluding": "9.1.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha1:*:*:*:*:*:*",
                    "matchCriteriaId": "6A2B14A3-8FAE-4C32-9E1A-F32D49E1EFAE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha2:*:*:*:*:*:*",
                    "matchCriteriaId": "35E90E01-47E7-44CB-A617-385AB0E6CB9F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta1:*:*:*:*:*:*",
                    "matchCriteriaId": "FC00B1CC-C522-44FC-AB04-973D0E75C4E8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta2:*:*:*:*:*:*",
                    "matchCriteriaId": "7248C01A-3848-4E22-AC9D-9D0E9D31EE80",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:cr1:*:*:*:*:*:*",
                    "matchCriteriaId": "3FDEC571-F826-4993-ABE3-3E94ECA684C5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."
          },
          {
            "lang": "es",
            "value": "Se ha descubierto que el cliente Hotrod en Infinispan, en versiones anteriores a la 9.2.0.CR1 lee de forma insegura los datos deserializados en la informaci\u00f3n de la cach\u00e9. Un atacante autenticado podr\u00eda inyectar un objeto malicioso en la cach\u00e9 de datos y lograr la deserializaci\u00f3n en el cliente, adem\u00e1s de llevar a cabo ataques a mayores."
          }
        ],
        "id": "CVE-2017-15089",
        "lastModified": "2024-11-21T03:14:02.923",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2018-02-15T17:29:00.207",
        "references": [
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securitytracker.com/id/1040360"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0294"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2018:0478"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2018:0479"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2018:0480"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2018:0481"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2018:0501"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2019:1326"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/infinispan/infinispan/pull/5639"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://www.securitytracker.com/id/1040360"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0294"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2018:0478"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2018:0479"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2018:0480"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2018:0481"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2018:0501"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHSA-2019:1326"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/infinispan/infinispan/pull/5639"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-04T18:42:08+00:00",
      "cve": "CVE-2017-15089",
      "id": "CVE-2017-15089",
      "initial_release_date": "2017-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "7",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "infinispan: Unsafe deserialization of malicious object injected into data cache",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-15089.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2017-15089

Vulnerability from fkie_nvd - Published: 2018-02-15 17:29 - Updated: 2026-06-17 01:07

Severity

8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
secalert@redhat.com	http://www.securitytracker.com/id/1040360	Third Party Advisory, VDB Entry
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:0294	Third Party Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:0478
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:0479
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:0480
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:0481
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:0501
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2019:1326
secalert@redhat.com	https://github.com/infinispan/infinispan/pull/5639	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1040360	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:0294	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:0478
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:0479
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:0480
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:0481
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:0501
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2019:1326
af854a3a-2127-422b-91ae-364da2661108	https://github.com/infinispan/infinispan/pull/5639	Patch, Third Party Advisory

Impacted products

Vendor	Product	Version
infinispan	infinispan	*
infinispan	infinispan	9.2.0
infinispan	infinispan	9.2.0
infinispan	infinispan	9.2.0
infinispan	infinispan	9.2.0
infinispan	infinispan	9.2.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "infinispan",
          "vendor": "Infinispan",
          "versions": [
            {
              "status": "affected",
              "version": "before 9.2.0.CR1"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73C3E6FB-4EE2-4538-A190-3F680D9E7A3B",
              "versionEndIncluding": "9.1.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "6A2B14A3-8FAE-4C32-9E1A-F32D49E1EFAE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "35E90E01-47E7-44CB-A617-385AB0E6CB9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "FC00B1CC-C522-44FC-AB04-973D0E75C4E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "7248C01A-3848-4E22-AC9D-9D0E9D31EE80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:cr1:*:*:*:*:*:*",
              "matchCriteriaId": "3FDEC571-F826-4993-ABE3-3E94ECA684C5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto que el cliente Hotrod en Infinispan, en versiones anteriores a la 9.2.0.CR1 lee de forma insegura los datos deserializados en la informaci\u00f3n de la cach\u00e9. Un atacante autenticado podr\u00eda inyectar un objeto malicioso en la cach\u00e9 de datos y lograr la deserializaci\u00f3n en el cliente, adem\u00e1s de llevar a cabo ataques a mayores."
    }
  ],
  "id": "CVE-2017-15089",
  "lastModified": "2026-06-17T01:07:13.687",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-02-15T17:29:00.207",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1040360"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:0294"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2018:0478"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2018:0479"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2018:0480"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2018:0481"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2018:0501"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2019:1326"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/infinispan/infinispan/pull/5639"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1040360"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:0294"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2018:0478"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2018:0479"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2018:0480"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2018:0481"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2018:0501"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2019:1326"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/infinispan/infinispan/pull/5639"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-46R5-59FG-2FJC

Vulnerability from github – Published: 2022-05-14 00:59 – Updated: 2022-07-01 19:46

Summary

Deserialization of Untrusted Data in Infinispan

Details

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.2.0.Beta2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.infinispan:infinispan-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.0.CR1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-15089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-01T19:46:46Z",
    "nvd_published_at": "2018-02-15T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.",
  "id": "GHSA-46r5-59fg-2fjc",
  "modified": "2022-07-01T19:46:46Z",
  "published": "2022-05-14T00:59:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15089"
    },
    {
      "type": "WEB",
      "url": "https://github.com/infinispan/infinispan/pull/5639"
    },
    {
      "type": "WEB",
      "url": "https://github.com/infinispan/infinispan/commit/1deadcb1c74ea0337abd5382c0150b000f6b106f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/infinispan/infinispan/commit/2944b0d1369a230bde88392b222921537c99331e"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0294"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0478"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0479"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0480"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0481"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:0501"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:1326"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/infinispan/infinispan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deserialization of Untrusted Data in Infinispan"
}

GSD-2017-15089

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2017-15089

Aliases

CVE-2017-15089

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-15089",
    "description": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.",
    "id": "GSD-2017-15089",
    "references": [
      "https://access.redhat.com/errata/RHSA-2020:2561",
      "https://access.redhat.com/errata/RHSA-2019:1326",
      "https://access.redhat.com/errata/RHSA-2018:0501",
      "https://access.redhat.com/errata/RHSA-2018:0481",
      "https://access.redhat.com/errata/RHSA-2018:0480",
      "https://access.redhat.com/errata/RHSA-2018:0479",
      "https://access.redhat.com/errata/RHSA-2018:0478",
      "https://access.redhat.com/errata/RHSA-2018:0294"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-15089"
      ],
      "details": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.",
      "id": "GSD-2017-15089",
      "modified": "2023-12-13T01:20:58.507661Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "DATE_PUBLIC": "2018-02-12T00:00:00",
        "ID": "CVE-2017-15089",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "infinispan",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "before 9.2.0.CR1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Infinispan"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-502"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "1040360",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1040360"
          },
          {
            "name": "RHSA-2018:0479",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:0479"
          },
          {
            "name": "RHSA-2018:0481",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:0481"
          },
          {
            "name": "https://github.com/infinispan/infinispan/pull/5639",
            "refsource": "CONFIRM",
            "url": "https://github.com/infinispan/infinispan/pull/5639"
          },
          {
            "name": "RHSA-2018:0294",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:0294"
          },
          {
            "name": "RHSA-2018:0501",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:0501"
          },
          {
            "name": "RHSA-2018:0480",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:0480"
          },
          {
            "name": "RHSA-2018:0478",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:0478"
          },
          {
            "name": "RHSA-2019:1326",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:1326"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,9.2.0.Beta2]",
          "affected_versions": "All versions up to 9.2.0.beta2",
          "cvss_v2": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-502",
            "CWE-937"
          ],
          "date": "2022-08-16",
          "description": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.",
          "fixed_versions": [
            "9.2.0.CR1"
          ],
          "identifier": "CVE-2017-15089",
          "identifiers": [
            "GHSA-46r5-59fg-2fjc",
            "CVE-2017-15089"
          ],
          "not_impacted": "All versions after 9.2.0.beta2",
          "package_slug": "maven/org.infinispan/infinispan-core",
          "pubdate": "2022-05-14",
          "solution": "Upgrade to version 9.2.0.CR1 or above.",
          "title": "Deserialization of Untrusted Data",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-15089",
            "https://github.com/infinispan/infinispan/pull/5639",
            "https://access.redhat.com/errata/RHSA-2018:0294",
            "https://access.redhat.com/errata/RHSA-2018:0478",
            "https://access.redhat.com/errata/RHSA-2018:0479",
            "https://access.redhat.com/errata/RHSA-2018:0480",
            "https://access.redhat.com/errata/RHSA-2018:0481",
            "https://access.redhat.com/errata/RHSA-2018:0501",
            "https://access.redhat.com/errata/RHSA-2019:1326",
            "https://github.com/advisories/GHSA-46r5-59fg-2fjc"
          ],
          "uuid": "bbc33908-62f2-41b6-9397-de28990fad68"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:infinispan:infinispan:9.2.0:cr1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "9.1.6",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2017-15089"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-502"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/infinispan/infinispan/pull/5639",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/infinispan/infinispan/pull/5639"
            },
            {
              "name": "RHSA-2018:0294",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:0294"
            },
            {
              "name": "1040360",
              "refsource": "SECTRACK",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securitytracker.com/id/1040360"
            },
            {
              "name": "RHSA-2018:0481",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2018:0481"
            },
            {
              "name": "RHSA-2018:0480",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2018:0480"
            },
            {
              "name": "RHSA-2018:0479",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2018:0479"
            },
            {
              "name": "RHSA-2018:0478",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2018:0478"
            },
            {
              "name": "RHSA-2018:0501",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2018:0501"
            },
            {
              "name": "RHSA-2019:1326",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2019:1326"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2019-06-04T17:29Z",
      "publishedDate": "2018-02-15T17:29Z"
    }
  }
}

OESA-2021-1139 (CVE-2017-15089)

Vulnerability from osv_openeuler – Published: 2021-04-07 11:04 – Updated: 2026-08-06 11:04 – Source website

Summary

infinispan security update

Details

Infinispan is an extremely scalable, highly available data grid platform - 100% open source, and written in Java. The purpose of Infinispan is to expose a data structure that is highly concurrent, designed ground-up to make the most of modern multi-processor/multi-core architectures while at the same time providing distributed cache capabilities. At its core Infinispan exposes a Cache interface which extends java.util.Map. It is also optionally is backed by a peer-to-peer network architecture to distribute state efficiently around a data grid.

Security Fix(es):

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.(CVE-2016-0750)

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://openeuler.org/en/security/safety-bulletin…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2017-15089	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2016-0750	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "infinispan-8.2.4-8.oe1.noarch.rpm",
          "infinispan-help-8.2.4-8.oe1.noarch.rpm"
        ],
        "src": [
          "infinispan-8.2.4-8.oe1.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "infinispan",
        "purl": "pkg:rpm/openEuler/infinispan\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.2.4-8.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Infinispan is an extremely scalable, highly available data grid platform - 100% open source, and written in Java. The purpose of Infinispan is to expose a data structure that is highly concurrent, designed ground-up to make the most of modern multi-processor/multi-core architectures while at the same time providing distributed cache capabilities.  At its core Infinispan exposes a Cache interface which extends java.util.Map. It is also optionally is backed by a peer-to-peer network architecture to distribute state efficiently around a data grid.\r\n\r\nSecurity Fix(es):\r\n\r\nIt was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.(CVE-2017-15089)\r\n\r\nThe hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.(CVE-2016-0750)",
  "id": "OESA-2021-1139",
  "modified": "2026-08-06T11:04:22Z",
  "published": "2021-04-07T11:04:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1139"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15089"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0750"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "infinispan security update",
  "upstream": [
    "CVE-2017-15089",
    "CVE-2016-0750"
  ]
}

RHSA-2018:0294

Vulnerability from csaf_redhat - Published: 2018-02-12 17:19 - Updated: 2026-08-04 21:59

Summary

Red Hat Security Advisory: Red Hat JBoss Data Grid 7.1.2 security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2017-15089.

CVE-2017-15089

It was found that the Hotrod client in Infinispan would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

8.0 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2018:0294

Open the full advisory

RHSA-2018:0478

Vulnerability from csaf_redhat - Published: 2018-03-12 16:37 - Updated: 2026-08-04 21:57

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.1 security update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2017-15089.

CVE-2017-15089

8.0 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2018:0478

Open the full advisory

RHSA-2018:0479

Vulnerability from csaf_redhat - Published: 2018-03-12 17:04 - Updated: 2026-08-04 22:34

Summary

Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 on RHEL 6

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2017-15089.

CVE-2017-15089

8.0 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 155 products

https://access.redhat.com/errata/RHSA-2018:0479

Open the full advisory

RHSA-2018:0480

Vulnerability from csaf_redhat - Published: 2018-03-12 17:03 - Updated: 2026-08-04 21:57

Summary

Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 for RHEL 7

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2017-15089.

CVE-2017-15089

8.0 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 155 products

https://access.redhat.com/errata/RHSA-2018:0480

Open the full advisory

RHSA-2018:0481

Vulnerability from csaf_redhat - Published: 2018-03-12 17:31 - Updated: 2026-08-04 21:57

Summary

Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.1

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2017-15089.

CVE-2017-15089

8.0 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 6 products

https://access.redhat.com/errata/RHSA-2018:0481

Open the full advisory

RHSA-2018:0501

Vulnerability from csaf_redhat - Published: 2018-03-13 14:45 - Updated: 2026-08-04 21:55

Summary

Red Hat Security Advisory: Red Hat Single Sign-On 7.2.1 security update

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2017-15089.

CVE-2017-15089

8.0 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2018:0501

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2017-15089 (GCVE-0-2017-15089)

OESA-2021-1139 (CVE-2017-15089)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour