CVE-2021-31917
First published: Thu Apr 29 2021(Updated: )
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0) where an attacker can bypass authentication in a trivial manor on all REST endpoints when `DIGEST` is used as the authentication method (`authentication mechanisms`).
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Infinispan infinispan-server-rest | >=10.0.0<11.0.12 | |
| Infinispan infinispan-server-rest | >=12.0.0<12.1.4 | |
| Red Hat Data Grid | =8.0.0 | |
| Red Hat Data Grid | =8.0.1 | |
| Red Hat Data Grid | =8.1.0 | |
| Red Hat Data Grid | =8.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-31917?
CVE-2021-31917 is a vulnerability found in Red Hat DataGrid 8.x and Infinispan 10.0.0 through 12.0.0 that allows an attacker to bypass authentication on all REST endpoints when DIGEST is used as the authentication method.
What is the severity of CVE-2021-31917?
The severity of CVE-2021-31917 is critical with a CVSS score of 9.8.
How does CVE-2021-31917 impact data confidentiality?
CVE-2021-31917 poses a high threat to data confidentiality.
Which software versions are affected by CVE-2021-31917?
Red Hat DataGrid versions 8.0.0, 8.0.1, 8.1.0, and 8.1.1, as well as Infinispan versions 10.0.0 through 12.0.0, are affected by CVE-2021-31917.
How can I fix CVE-2021-31917?
To fix CVE-2021-31917, it is recommended to update to the latest versions of Red Hat DataGrid and Infinispan.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-31917
- agent/references
- agent/severity
- agent/weakness
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- agent/source
- vendor/infinispan
- canonical/infinispan infinispan-server-rest
- version/infinispan infinispan-server-rest/10.0.0
- version/infinispan infinispan-server-rest/12.0.0
- vendor/redhat
- canonical/red hat data grid
- version/red hat data grid/8.0.0
- version/red hat data grid/8.0.1
- version/red hat data grid/8.1.0
- version/red hat data grid/8.1.1