Vulnerability · Published Dec 18, 2023 · Assigned by redhat
CVE-2023-5384Infinispan: credentials returned from configuration as clear text
High 7.2
In plain English
A high-severity security flaw in Red Hat Data Grid 8.4.6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.infinispan:infinispan-cachestore-jdbc | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-cachestore-jdbc | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-cachestore-jdbc-common | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-cachestore-jdbc-common | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-cachestore-remote | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-cachestore-remote | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-cachestore-sql | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-cachestore-sql | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-client-hotrod | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-client-hotrod | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-commons | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-commons | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-core | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-core | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-hotrod | 14.0.25.Final | GHSA-gg57-587f-h5v6 |
| Maven | org.infinispan:infinispan-hotrod | 15.0.0.Dev07 | GHSA-gg57-587f-h5v6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Data Grid 8.4.6 | see references |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2023:7676 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-5384 vdb-entry, x_refsource_REDHAT
- RHBZ#2242156 issue-tracking, x_refsource_REDHAT
- https://security.netapp.com/advisory/ntap-20240125-0004/ x_transferred