CVE-2023-5384: Infinispan: credentials returned from configuration as clear text
First published: Wed Oct 04 2023(Updated: )
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Data Grid | <8.4.6 | |
| Redhat Jboss Data Grid | ||
| Infinispan Infinispan | ||
| maven/org.infinispan:infinispan-cachestore-jdbc | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-jdbc | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-cachestore-sql | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-sql | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-cachestore-remote | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-remote | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-cachestore-jdbc-common | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-jdbc-common | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-client-hotrod | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-client-hotrod | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-hotrod | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-hotrod | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-commons | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-commons | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-core | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-core | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| <8.4.6 | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2023:7676
- https://bugzilla.redhat.com/show_bug.cgi?id=2242156
- https://access.redhat.com/security/cve/CVE-2023-5384
- https://nvd.nist.gov/vuln/detail/CVE-2023-5384
- https://security.netapp.com/advisory/ntap-20240125-0004
- https://github.com/infinispan/infinispan/pull/11555
- https://github.com/infinispan/infinispan/pull/11995
- https://github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47
- https://github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61
- https://issues.redhat.com/browse/ISPN-15202
- https://github.com/advisories/GHSA-gg57-587f-h5v6 (Advisory)
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-5384
- agent/weakness
- agent/title
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gg57-587f-h5v6
- agent/references
- agent/severity
- agent/author
- agent/event
- agent/softwarecombine
- collector/nvd-cve
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/redhat
- canonical/redhat data grid
- canonical/redhat jboss data grid
- vendor/infinispan
- canonical/infinispan infinispan
- package-manager/maven