Bug 1300443 (CVE-2016-0750) - CVE-2016-0750 hotrod client: unchecked deserialization in marshaller util
Summary: CVE-2016-0750 hotrod client: unchecked deserialization in marshaller util
Keywords:
Status: MODIFIED
Alias: CVE-2016-0750
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1300436 1507638
TreeView+ depends on / blocked
 
Reported: 2016-01-20 20:35 UTC by Chess Hazlett
Modified: 2023-07-07 08:28 UTC (History)
2 users (show)

Fixed In Version: Infinispan 9.1.0.Final
Doc Type: Bug Fix
Doc Text:
The hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Clone Of:
Environment:
Last Closed: 2017-11-30 20:46:59 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:3244 0 normal SHIPPED_LIVE Important: Red Hat JBoss Data Grid 7.1.1 security update 2017-11-17 00:52:09 UTC
Red Hat Product Errata RHSA-2018:0501 0 normal SHIPPED_LIVE Moderate: Red Hat Single Sign-On 7.2.1 security update 2018-03-13 18:45:37 UTC

Description Chess Hazlett 2016-01-20 20:35:17 UTC 
It was discovered that the hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

code link:
https://github.com/infinispan/infinispan/blob/master/client/hotrod-client/src/main/java/org/infinispan/client/hotrod/marshall/MarshallerUtil.java#L39
Comment 2 Chess Hazlett 2017-11-07 20:35:35 UTC 
upstream: https://issues.jboss.org/browse/ISPN-7781
PR: https://github.com/infinispan/infinispan/pull/5116
Fixed in: Infinispan 9.1.0.Final
Comment 3 Chess Hazlett 2017-11-07 20:47:58 UTC 
Acknowledgments:

Name: Sebastian Olsson (TrueSec)
Comment 4 errata-xmlrpc 2017-11-16 19:52:25 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Data Grid

Via RHSA-2017:3244 https://access.redhat.com/errata/RHSA-2017:3244
Comment 5 Chess Hazlett 2018-03-02 15:29:13 UTC 
reopening flaw bug for adding to RHSAs
Comment 6 errata-xmlrpc 2018-03-13 14:47:17 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.2.1 zip

Via RHSA-2018:0501 https://access.redhat.com/errata/RHSA-2018:0501
Note You need to log in before you can comment on or make changes to this bug.