Latest redhat data grid Vulnerabilities

● CVE-2023-5384
Infinispan: credentials returned from configuration as clear text
<8.4.6
● CVE-2023-5236
Infinispan: circular reference on marshalling leads to dos
<8.4.4
● CVE-2023-4586
Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack
Redhat Data Grid=8.0.0
Infinispan Hot Rod
Netty Netty>=4.1.0<5.0.0
Netty Netty>=4.1.0<=4.1.99
● CVE-2023-3629
Infinispan: non-admins should not be able to get cache config via rest api
<8.4.4
=6
● CVE-2023-3628
Infispan: rest bulk ops don't check permissions
=6
<8.4.4
● CVE-2021-3642
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest th...
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea
and 47 more
● CVE-2021-31917
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as th...
Infinispan Infinispan-server-rest>=10.0.0<11.0.12
Infinispan Infinispan-server-rest>=12.0.0<12.1.4
Redhat Data Grid=8.0.0
Redhat Data Grid=8.0.1
Redhat Data Grid=8.1.0
Redhat Data Grid=8.1.1
● CVE-2021-3536
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affe...
redhat/Wildfly<23.0.2.
redhat/eap7-elytron-web<0:1.6.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.15-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-3.SP1_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.4.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.33-1.Final_redhat_00001.1.el6ea
and 45 more
● CVE-2020-25711
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can ...
redhat/Infinispan<11.0.6
Infinispan Infinispan<11.0.6
Redhat Data Grid=8.0
Netapp Active Iq Unified Manager Linux
Netapp Active Iq Unified Manager Vmware Vsphere
Netapp Active Iq Unified Manager Windows
● CVE-2020-25644
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest t...
maven/org.wildfly.openssl:wildfly-openssl-natives-parent<1.1.3.Final
redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el6ea
redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el6ea
redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el6ea
redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el6ea
and 67 more
● CVE-2020-10771
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request...
Infinispan Infinispan-server-rest=10.0.0
Redhat Data Grid=8.0
NetApp OnCommand Insight
● CVE-2019-14838
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
redhat/eap7-wildfly<0:7.2.4-2.SP1_redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.2.10-1.redhat_00001.1.el6ea
redhat/eap7-byte-buddy<0:1.9.11-1.redhat_00002.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-5.SP3_redhat_00003.1.el6ea
redhat/eap7-hal-console<0:3.0.17-2.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.13-1.Final_redhat_00001.1.el6ea
and 84 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203