CVE-2016-0750: High severity infinispan vulnerability
It was discovered that the hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
code link: https://github.com/infinispan/infinispan/blob/master/client/hotrod-client/src/main/java/org/infinispan/client/hotrod/marshall/MarshallerUtil.java#L39
Other sources
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0750?
CVE-2016-0750 is considered critical due to its potential for remote code execution.
How do I fix CVE-2016-0750?
To mitigate CVE-2016-0750, upgrade Infinispan to version 9.1.0 or later.
What products are affected by CVE-2016-0750?
CVE-2016-0750 affects Infinispan versions prior to 9.1.0.
What are the potential impacts of CVE-2016-0750?
Exploitation of CVE-2016-0750 can lead to remote code execution and unauthorized access.
Is CVE-2016-0750 related to deserialization vulnerabilities?
Yes, CVE-2016-0750 involves insecure deserialization allowing attackers to execute malicious code.