{"containers": {"cna": {"affected": [{"product": "infinispan", "vendor": "Infinispan", "versions": [{"status": "affected", "version": "before 9.2.0.CR1"}]}], "datePublic": "2018-02-12T00:00:00", "descriptions": [{"lang": "en", "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-06-04T16:06:03", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "1040360", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1040360"}, {"name": "RHSA-2018:0479", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"name": "RHSA-2018:0481", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/infinispan/infinispan/pull/5639"}, {"name": "RHSA-2018:0294", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0294"}, {"name": "RHSA-2018:0501", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0501"}, {"name": "RHSA-2018:0480", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"name": "RHSA-2018:0478", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"name": "RHSA-2019:1326", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:1326"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "DATE_PUBLIC": "2018-02-12T00:00:00", "ID": "CVE-2017-15089", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "infinispan", "version": {"version_data": [{"version_value": "before 9.2.0.CR1"}]}}]}, "vendor_name": "Infinispan"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-502"}]}]}, "references": {"reference_data": [{"name": "1040360", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040360"}, {"name": "RHSA-2018:0479", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"name": "RHSA-2018:0481", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"name": "https://github.com/infinispan/infinispan/pull/5639", "refsource": "CONFIRM", "url": "https://github.com/infinispan/infinispan/pull/5639"}, {"name": "RHSA-2018:0294", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0294"}, {"name": "RHSA-2018:0501", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0501"}, {"name": "RHSA-2018:0480", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"name": "RHSA-2018:0478", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"name": "RHSA-2019:1326", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1326"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:50:14.965Z"}, "title": "CVE Program Container", "references": [{"name": "1040360", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1040360"}, {"name": "RHSA-2018:0479", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"name": "RHSA-2018:0481", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/infinispan/infinispan/pull/5639"}, {"name": "RHSA-2018:0294", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0294"}, {"name": "RHSA-2018:0501", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0501"}, {"name": "RHSA-2018:0480", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"name": "RHSA-2018:0478", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"name": "RHSA-2019:1326", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:1326"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2017-15089", "datePublished": "2018-02-15T17:00:00Z", "dateReserved": "2017-10-08T00:00:00", "dateUpdated": "2024-09-16T19:05:25.998Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*", "matchCriteriaId": "73C3E6FB-4EE2-4538-A190-3F680D9E7A3B", "versionEndIncluding": "9.1.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "6A2B14A3-8FAE-4C32-9E1A-F32D49E1EFAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "35E90E01-47E7-44CB-A617-385AB0E6CB9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "FC00B1CC-C522-44FC-AB04-973D0E75C4E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "7248C01A-3848-4E22-AC9D-9D0E9D31EE80", "vulnerable": true}, {"criteria": "cpe:2.3:a:infinispan:infinispan:9.2.0:cr1:*:*:*:*:*:*", "matchCriteriaId": "3FDEC571-F826-4993-ABE3-3E94ECA684C5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."}, {"lang": "es", "value": "Se ha descubierto que el cliente Hotrod en Infinispan, en versiones anteriores a la 9.2.0.CR1 lee de forma insegura los datos deserializados en la informaci\u00f3n de la cach\u00e9. Un atacante autenticado podr\u00eda inyectar un objeto malicioso en la cach\u00e9 de datos y lograr la deserializaci\u00f3n en el cliente, adem\u00e1s de llevar a cabo ataques a mayores."}], "id": "CVE-2017-15089", "lastModified": "2024-11-21T03:14:02.923", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-02-15T17:29:00.207", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040360"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0294"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2018:0501"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2019:1326"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/infinispan/infinispan/pull/5639"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1040360"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0294"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2018:0501"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:1326"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/infinispan/infinispan/pull/5639"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Man Yue Mo (Semmle/lgtm.com) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2019:1326", "cpe": "cpe:/a:redhat:jboss_fuse:6.3", "package": "Camel", "product_name": "Red Hat Fuse 6.3", "release_date": "2019-06-04T00:00:00Z"}, {"advisory": "RHSA-2018:0294", "cpe": "cpe:/a:redhat:jboss_data_grid:7.1", "product_name": "Red Hat JBoss Data Grid 7.1", "release_date": "2018-02-12T00:00:00Z"}, {"advisory": "RHSA-2018:0478", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "package": "infinispan-core", "product_name": "Red Hat JBoss EAP 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-infinispan-0:8.2.9-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-ironjacamar-0:1.4.7-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jackson-annotations-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jackson-core-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jackson-databind-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jackson-jaxrs-providers-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jackson-module-jaxb-annotations-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jackson-modules-java8-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jboss-logmanager-0:2.0.8-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jboss-server-migration-0:1.0.3-6.Final_redhat_6.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jbossws-cxf-0:5.1.10-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-narayana-0:5.5.31-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-picketlink-bindings-0:2.5.5-10.SP9_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-picketlink-federation-0:2.5.5-10.SP9_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-resteasy-0:3.0.25-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-undertow-0:1.4.18-4.SP2_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-undertow-jastow-0:2.0.3-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-wildfly-0:7.1.1-4.GA_redhat_2.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-wildfly-elytron-0:1.1.8-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-wildfly-http-client-0:1.0.9-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-wildfly-javadocs-0:7.1.1-3.GA_redhat_2.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-wss4j-0:2.1.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-xml-security-0:2.0.9-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0481", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "package": "eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-infinispan-0:8.2.9-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-ironjacamar-0:1.4.7-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jackson-annotations-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jackson-core-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jackson-databind-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jackson-jaxrs-providers-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jackson-module-jaxb-annotations-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jackson-modules-java8-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jboss-logmanager-0:2.0.8-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jboss-server-migration-0:1.0.3-6.Final_redhat_6.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jbossws-cxf-0:5.1.10-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-narayana-0:5.5.31-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-picketlink-bindings-0:2.5.5-10.SP9_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-picketlink-federation-0:2.5.5-10.SP9_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-resteasy-0:3.0.25-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-undertow-0:1.4.18-4.SP2_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-undertow-jastow-0:2.0.3-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-wildfly-0:7.1.1-4.GA_redhat_2.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-wildfly-elytron-0:1.1.8-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-wildfly-http-client-0:1.0.9-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-wildfly-javadocs-0:7.1.1-3.GA_redhat_2.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-wss4j-0:2.1.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-xml-security-0:2.0.9-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0481", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "package": "eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2020:2561", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_cd:12", "package": "infinispan-core", "product_name": "Red Hat JBoss Enterprise Application Platform Continuous Delivery", "release_date": "2020-06-15T00:00:00Z"}, {"advisory": "RHSA-2018:0501", "cpe": "cpe:/a:redhat:jboss_single_sign_on:7.2", "product_name": "Red Hat Single Sign-On 7.2.1 zip", "release_date": "2018-03-13T00:00:00Z"}], "bugzilla": {"description": "infinispan: Unsafe deserialization of malicious object injected into data cache", "id": "1503610", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1503610"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.0", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-502", "details": ["It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.", "It was found that the Hotrod client in Infinispan would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks."], "name": "CVE-2017-15089", "package_state": [{"cpe": "cpe:/a:redhat:jboss_data_grid:6", "fix_state": "Will not fix", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Data Grid 6"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Affected", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_data_virtualization:6", "fix_state": "Not affected", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Data Virtualization 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Under investigation", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:fuse_integration_services:2", "fix_state": "Affected", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Fuse Integration Service 2"}, {"cpe": "cpe:/a:redhat:jboss_fuse_service_works:6", "fix_state": "Will not fix", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Fuse Service Works 6"}, {"cpe": "cpe:/a:redhat:jboss_operations_network:3", "fix_state": "Not affected", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Operations Network 3"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6", "fix_state": "Will not fix", "package_name": "infinispan-core", "product_name": "Red Hat JBoss Portal 6"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Affected", "package_name": "infinispan-core", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/o:redhat:rhev_hypervisor:4", "fix_state": "Will not fix", "impact": "moderate", "package_name": "eap7-infinispan-core", "product_name": "Red Hat Virtualization 4"}], "public_date": "2018-02-12T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-15089\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-15089"], "threat_severity": "Important", "upstream_fix": "Infinispan 8.2.9.Final, Infinispan 9.2.0.Final"}