REDHAT-BUG-2217924: Medium severity infinispan Infinispan vulnerability
The REST bulk read endpoints: /rest/v2/caches/{cacheName}?action=keys /rest/v2/caches/{cacheName}?action=entries use the cluster publisher, which is an internal component which doesn't check that the subject has bulk read permissions The methods require authentication, but once authenticated, any user can invoke them successfully.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2217924?
The severity level of REDHAT-BUG-2217924 is yet to be officially rated but it involves inadequate permission checks for critical REST bulk read endpoints.
How do I fix REDHAT-BUG-2217924?
To fix REDHAT-BUG-2217924, ensure that you apply security patches provided by Red Hat for Infinispan as they address the insufficient permission checks.
Which software versions are affected by REDHAT-BUG-2217924?
REDHAT-BUG-2217924 affects all supported versions of Infinispan due to the vulnerability present in bulk read endpoints.
What types of endpoints are involved in REDHAT-BUG-2217924?
REDHAT-BUG-2217924 involves REST bulk read endpoints for fetching cache keys and entries.
What authentication mechanism is used in REDHAT-BUG-2217924?
In REDHAT-BUG-2217924, the endpoints require authentication but overlook permission validations for bulk read actions.