Bug 2342233 (CVE-2025-0736)

Summary:	CVE-2025-0736 org.infinispan-infinispan-parent: Exposure of Sensitive Information in Application Logs
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, fjuma, istudens, ivassile, iweiss, lgao, mosmerov, msochure, msvehla, nwallace, pesilva, pjindal, pmackay, rstancel, smaestri, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-01-27 11:47:49 UTC

A vulnerability has been identified in Infinispan where sensitive credentials, such as database usernames and passwords, are logged when using JGroups with JDBC_PING. If a misconfiguration (such as an unresolved external_addr) occurs, the logging mechanism records connection details, including credentials, in plaintext.

This issue can lead to credential exposure, potentially allowing unauthorized access if logs are accessible to low-privileged users or attackers.

Comment 3 errata-xmlrpc 2025-03-11 14:10:15 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid

Via RHSA-2025:2663 https://access.redhat.com/errata/RHSA-2025:2663