CVE-2017-2638
First published: Thu Mar 02 2017(Updated: )
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.infinispan:infinispan-server-core | <9.0.0 | 9.0.0 |
| redhat/Infinispan | <9.0.0. | 9.0.0. |
| Infinispan | <9.0.0 | |
| Red Hat JBoss Data Grid | =7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-2638
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638
- https://issues.jboss.org/browse/ISPN-7485
- http://rhn.redhat.com/errata/RHSA-2017-1097.html
- http://www.securityfocus.com/bid/97964
- https://github.com/infinispan/infinispan/pull/4936
- https://github.com/advisories/GHSA-mvxp-3j62-jqr6 (Advisory)
- https://github.com/infinispan/infinispan/pull/4936/commits
- https://access.redhat.com/errata/RHSA-2017:1097
- https://bugzilla.redhat.com/show_bug.cgi?id=1428564
Frequently Asked Questions
What is the severity of CVE-2017-2638?
The severity of CVE-2017-2638 is classified as medium, as it allows unauthorized access to sensitive data.
How do I fix CVE-2017-2638?
To fix CVE-2017-2638, upgrade to Infinispan version 9.0.0 or later.
What systems are affected by CVE-2017-2638?
CVE-2017-2638 affects Infinispan versions prior to 9.0.0 and Red Hat JBoss Data Grid version 7.1.
What is the impact of CVE-2017-2638?
The impact of CVE-2017-2638 is that an attacker could read or modify data in the default cache without authentication.
Is authentication enforced in CVE-2017-2638?
No, authentication is not properly enforced in the REST API of Infinispan prior to version 9.0.0.
- collector/github-advisory
- alias/GHSA-mvxp-3j62-jqr6
- alias/CVE-2017-2638
- collector/github-advisory-latest
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/severity
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- package-manager/maven
- package-manager/redhat
- vendor/infinispan
- canonical/infinispan
- vendor/redhat
- canonical/red hat jboss data grid
- version/red hat jboss data grid/7.1