CVE-2019-10158: Critical severity infinispan Infinispan vulnerability
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
Other sources
A vulnerability was found in Infinispan up to version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration may result in an incorrect session handling
Referrences: https://issues.jboss.org/browse/ISPN-10224
Upstream Patch: https://github.com/infinispan/infinispan/pull/6960
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.infinispan:infinispan-coreto a version that resolves this vulnerability.Fixed in 9.4.15.Final
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in Infinispan?
The vulnerability ID for this flaw in Infinispan is CVE-2019-10158.
What is the severity of CVE-2019-10158?
The severity of CVE-2019-10158 is critical.
Which versions of Infinispan are affected by CVE-2019-10158?
Versions up to and including 9.4.14.Final of Infinispan are affected by CVE-2019-10158.
What is the impact of the vulnerability in the Spring Session integration of Infinispan?
The vulnerability in the Spring Session integration of Infinispan can result in incorrect session handling.
Are there any fixes or patches available for CVE-2019-10158?
Yes, fixes are available. Please refer to the provided references for more information.