LOW2.7
GHSA-gg57-587f-h5v6
Infinispan caches credentials in clear text
Quick fix
GHSA-gg57-587f-h5v6 — org.infinispan:infinispan-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-coreDetails
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.infinispan:infinispan-core
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-coreMaven/org.infinispan:infinispan-core
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-coreMaven/org.infinispan:infinispan-commons
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-commonsMaven/org.infinispan:infinispan-commons
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-commonsMaven/org.infinispan:infinispan-hotrod
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-hotrodMaven/org.infinispan:infinispan-hotrod
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-hotrodMaven/org.infinispan:infinispan-client-hotrod
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-client-hotrodMaven/org.infinispan:infinispan-client-hotrod
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-client-hotrodMaven/org.infinispan:infinispan-cachestore-jdbc-common
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-cachestore-jdbc-commonMaven/org.infinispan:infinispan-cachestore-jdbc-common
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-cachestore-jdbc-commonMaven/org.infinispan:infinispan-cachestore-remote
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-cachestore-remoteMaven/org.infinispan:infinispan-cachestore-remote
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-cachestore-remoteMaven/org.infinispan:infinispan-cachestore-sql
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-cachestore-sqlMaven/org.infinispan:infinispan-cachestore-sql
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-cachestore-sqlMaven/org.infinispan:infinispan-cachestore-jdbc
Introduced in:
15.0.0.Dev01Fixed in: 15.0.0.Dev07Fix
# pom.xml: bump <version>15.0.0.Dev07</version> for org.infinispan:infinispan-cachestore-jdbcMaven/org.infinispan:infinispan-cachestore-jdbc
Introduced in:
0Fixed in: 14.0.25.FinalFix
# pom.xml: bump <version>14.0.25.Final</version> for org.infinispan:infinispan-cachestore-jdbcReferences
- https://nvd.nist.gov/vuln/detail/CVE-2023-5384[ADVISORY]
- https://github.com/infinispan/infinispan/pull/11555[WEB]
- https://github.com/infinispan/infinispan/pull/11995[WEB]
- https://github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47[WEB]
- https://github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61[WEB]
- https://access.redhat.com/errata/RHSA-2023:7676[WEB]
- https://access.redhat.com/security/cve/CVE-2023-5384[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2242156[WEB]
- https://github.com/infinispan/infinispan[PACKAGE]
- https://issues.redhat.com/browse/ISPN-15202[WEB]
- https://security.netapp.com/advisory/ntap-20240125-0004[WEB]