CVE-2021-31917: Critical severity infinispan vulnerability
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0) where an attacker can bypass authentication in a trivial manor on all REST endpoints when DIGEST is used as the authentication method (authentication mechanisms).
Other sources
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in Red Hat DataGrid and Infinispan. An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-31917?
CVE-2021-31917 is a vulnerability found in Red Hat DataGrid 8.x and Infinispan 10.0.0 through 12.0.0 that allows an attacker to bypass authentication on all REST endpoints when DIGEST is used as the authentication method.
What is the severity of CVE-2021-31917?
The severity of CVE-2021-31917 is critical with a CVSS score of 9.8.
How does CVE-2021-31917 impact data confidentiality?
CVE-2021-31917 poses a high threat to data confidentiality.
Which software versions are affected by CVE-2021-31917?
Red Hat DataGrid versions 8.0.0, 8.0.1, 8.1.0, and 8.1.1, as well as Infinispan versions 10.0.0 through 12.0.0, are affected by CVE-2021-31917.
How can I fix CVE-2021-31917?
To fix CVE-2021-31917, it is recommended to update to the latest versions of Red Hat DataGrid and Infinispan.