CVE-2023-5384: Infinispan: credentials returned from configuration as clear text
First published: Wed Oct 04 2023(Updated: )
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.infinispan:infinispan-cachestore-jdbc | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-jdbc | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-cachestore-sql | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-sql | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-cachestore-remote | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-remote | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-cachestore-jdbc-common | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-cachestore-jdbc-common | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-client-hotrod | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-client-hotrod | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-hotrod | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-hotrod | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-commons | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-commons | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| maven/org.infinispan:infinispan-core | <14.0.25.Final | 14.0.25.Final |
| maven/org.infinispan:infinispan-core | >=15.0.0.Dev01<15.0.0.Dev07 | 15.0.0.Dev07 |
| Red Hat Data Grid | <8.4.6 | |
| redhat jboss data grid | ||
| Infinispan Infinispan |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2023:7676
- https://bugzilla.redhat.com/show_bug.cgi?id=2242156
- https://access.redhat.com/security/cve/CVE-2023-5384
- https://nvd.nist.gov/vuln/detail/CVE-2023-5384
- https://security.netapp.com/advisory/ntap-20240125-0004
- https://github.com/infinispan/infinispan/pull/11555
- https://github.com/infinispan/infinispan/pull/11995
- https://github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47
- https://github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61
- https://issues.redhat.com/browse/ISPN-15202
- https://github.com/advisories/GHSA-gg57-587f-h5v6 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2023-5384?
CVE-2023-5384 has been classified with a high severity level due to the exposure of sensitive credentials in clear text.
How do I fix CVE-2023-5384?
To remediate CVE-2023-5384, you should upgrade to versions 14.0.25.Final or 15.0.0.Dev07 of the affected Infinispan packages.
Which Infinispan versions are affected by CVE-2023-5384?
CVE-2023-5384 affects versions prior to 14.0.25.Final and versions between 15.0.0.Dev01 and 15.0.0.Dev07.
What specific packages are vulnerable due to CVE-2023-5384?
The vulnerable packages include infinispan-cachestore-jdbc, infinispan-cachestore-sql, infinispan-cachestore-remote, infinispan-client-hotrod, and others.
Is CVE-2023-5384 applicable to Red Hat Data Grid users?
Yes, CVE-2023-5384 affects Red Hat Data Grid versions prior to 8.4.6.
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-5384
- agent/weakness
- agent/title
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gg57-587f-h5v6
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/author
- agent/event
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/maven
- vendor/redhat
- canonical/red hat data grid
- canonical/redhat jboss data grid
- vendor/infinispan
- canonical/infinispan infinispan