GHSA-qqfc-m9hc-pqv3
Deserialization of Untrusted Data in Infinispan
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.infinispan:infinispan-core | 8.2.10.Final | no fix listed |
| Maven | org.infinispan:infinispan-core | 9.0.3.Final | no fix listed |
| Maven | org.infinispan:infinispan-core | 9.1.7.Final | no fix listed |
| Maven | org.infinispan:infinispan-core | 9.2.2.Final | no fix listed |
| Maven | org.infinispan:infinispan-core | >= 9.3.0.Alpha1, < 9.3.1.Final | 9.3.1.Final |
Details
As written in the advisory (Markdown source, shown as plain text).
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
References
External links from the advisory. They lead to third-party sites.