CVE-2019-10158
First published: Mon May 27 2019(Updated: )
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <=9.4.14 | ||
| =7.0.0 | ||
| Infinispan Infinispan | <=9.4.14 | |
| Redhat Jboss Data Grid | =7.0.0 | |
| maven/org.infinispan:infinispan-core | <9.4.15.Final | 9.4.15.Final |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-10158
- https://github.com/infinispan/infinispan/pull/6960
- https://github.com/infinispan/infinispan/pull/7025
- https://github.com/infinispan/infinispan/commit/4b381c5910265972ccaabefbdbd16a2b929f6b72
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158
- https://github.com/infinispan/infinispan/pull/7043
- https://github.com/infinispan/infinispan/commits/9.4.15.Final/
- https://security.netapp.com/advisory/ntap-20231227-0009/
- https://github.com/advisories/GHSA-6x3v-rw2q-9gx7 (Advisory)
- https://issues.jboss.org/browse/ISPN-10224
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1714360
- https://access.redhat.com/errata/RHSA-2019:4037
- https://bugzilla.redhat.com/show_bug.cgi?id=1714359
Frequently Asked Questions
What is the vulnerability ID for this flaw in Infinispan?
The vulnerability ID for this flaw in Infinispan is CVE-2019-10158.
What is the severity of CVE-2019-10158?
The severity of CVE-2019-10158 is critical.
Which versions of Infinispan are affected by CVE-2019-10158?
Versions up to and including 9.4.14.Final of Infinispan are affected by CVE-2019-10158.
What is the impact of the vulnerability in the Spring Session integration of Infinispan?
The vulnerability in the Spring Session integration of Infinispan can result in incorrect session handling.
Are there any fixes or patches available for CVE-2019-10158?
Yes, fixes are available. Please refer to the provided references for more information.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- source/GitHub
- alias/GHSA-6x3v-rw2q-9gx7
- alias/CVE-2019-10158
- agent/software-canonical-lookup
- collector/github-advisory-latest
- collector/mitre-cve
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- package-manager/maven
- vendor/infinispan
- canonical/infinispan infinispan
- version/infinispan infinispan/9.4.14
- vendor/redhat
- canonical/redhat jboss data grid
- version/redhat jboss data grid/7.0.0