rhsa-2025:2663
Vulnerability from csaf_redhat
Published
2025-03-11 14:10
Modified
2025-04-02 20:23
Summary
Red Hat Security Advisory: Red Hat Data Grid 8.5.3 security update

Notes

Topic
An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale. Data Grid 8.5.3 replaces Data Grid 8.5.2 and includes bug fixes and enhancements. Find out more about Data Grid 8.5.3 in the Release Notes[3]. Security Fix(es): * CVE-2025-24970 io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine [jdg-8] (CVE-2025-24970) * CVE-2025-0736 org.infinispan-infinispan-parent: Exposure of Sensitive Information in Application Logs [jdg-8] (CVE-2025-0736) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for Red Hat Data Grid 8 is now available.\n \nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.\n \nData Grid 8.5.3 replaces Data Grid 8.5.2 and includes bug fixes and enhancements. Find out more about Data Grid 8.5.3 in the Release Notes[3].\n\nSecurity Fix(es):\n\n* CVE-2025-24970 io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine [jdg-8] (CVE-2025-24970)\n\n* CVE-2025-0736 org.infinispan-infinispan-parent: Exposure of Sensitive Information in Application Logs [jdg-8] (CVE-2025-0736)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2025:2663",
            url: "https://access.redhat.com/errata/RHSA-2025:2663",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2342233",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2342233",
         },
         {
            category: "external",
            summary: "2344787",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2344787",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2663.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Data Grid 8.5.3 security update",
      tracking: {
         current_release_date: "2025-04-02T20:23:29+00:00",
         generator: {
            date: "2025-04-02T20:23:29+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2025:2663",
         initial_release_date: "2025-03-11T14:10:03+00:00",
         revision_history: [
            {
               date: "2025-03-11T14:10:03+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2025-03-11T14:10:03+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-02T20:23:29+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Data Grid",
                        product: {
                           name: "Red Hat Data Grid",
                           product_id: "Red Hat Data Grid",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_data_grid:8",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Data Grid",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Vika Vorkin",
               ],
            },
         ],
         cve: "CVE-2025-0736",
         cwe: {
            id: "CWE-532",
            name: "Insertion of Sensitive Information into Log File",
         },
         discovery_date: "2025-01-27T11:14:12.725000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2342233",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "org.infinispan-infinispan-parent: Exposure of Sensitive Information in Application Logs",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Data Grid",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2025-0736",
            },
            {
               category: "external",
               summary: "RHBZ#2342233",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2342233",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2025-0736",
               url: "https://www.cve.org/CVERecord?id=CVE-2025-0736",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2025-0736",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2025-0736",
            },
         ],
         release_date: "2025-01-27T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-11T14:10:03+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
               product_ids: [
                  "Red Hat Data Grid",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2663",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Red Hat Data Grid",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "org.infinispan-infinispan-parent: Exposure of Sensitive Information in Application Logs",
      },
      {
         cve: "CVE-2025-24970",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2025-02-10T23:00:52.785132+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2344787",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty's SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This vulnerability in Netty's SslHandler is of important severity rather than moderate because it directly impacts the stability and reliability of applications using native SSLEngine. By sending a specially crafted packet, an attacker can trigger a native crash, leading to a complete process termination. Unlike typical moderate vulnerabilities that might cause limited disruptions or require specific conditions, this flaw can be exploited remotely to induce a Denial of Service (DoS), affecting high-availability systems and mission-critical services.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat Data Grid",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2025-24970",
            },
            {
               category: "external",
               summary: "RHBZ#2344787",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2344787",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2025-24970",
               url: "https://www.cve.org/CVERecord?id=CVE-2025-24970",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2025-24970",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2025-24970",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4",
               url: "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw",
               url: "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw",
            },
         ],
         release_date: "2025-02-10T21:57:28.730000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-11T14:10:03+00:00",
               details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
               product_ids: [
                  "Red Hat Data Grid",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2663",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "Red Hat Data Grid",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Red Hat Data Grid",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.