Bug 1300443 (CVE-2016-0750)

Summary:	CVE-2016-0750 hotrod client: unchecked deserialization in marshaller util
Product:	[Other] Security Response	Reporter:	Chess Hazlett <chazlett>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	MODIFIED ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	chazlett, ttarrant
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Infinispan 9.1.0.Final	Doc Type:	Bug Fix
Doc Text:	The hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-30 20:46:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1300436, 1507638

Description Chess Hazlett 2016-01-20 20:35:17 UTC

It was discovered that the hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

code link:
https://github.com/infinispan/infinispan/blob/master/client/hotrod-client/src/main/java/org/infinispan/client/hotrod/marshall/MarshallerUtil.java#L39

Comment 2 Chess Hazlett 2017-11-07 20:35:35 UTC

upstream: https://issues.jboss.org/browse/ISPN-7781
PR: https://github.com/infinispan/infinispan/pull/5116
Fixed in: Infinispan 9.1.0.Final

Comment 3 Chess Hazlett 2017-11-07 20:47:58 UTC

Acknowledgments:

Name: Sebastian Olsson (TrueSec)

Comment 4 errata-xmlrpc 2017-11-16 19:52:25 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Data Grid

Via RHSA-2017:3244 https://access.redhat.com/errata/RHSA-2017:3244

Comment 5 Chess Hazlett 2018-03-02 15:29:13 UTC

reopening flaw bug for adding to RHSAs

Comment 6 errata-xmlrpc 2018-03-13 14:47:17 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.2.1 zip

Via RHSA-2018:0501 https://access.redhat.com/errata/RHSA-2018:0501