Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nZzU3LTU4N2YtaDV2Ns4AA429

Infinispan caches credentials in clear text

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

Permalink: https://github.com/advisories/GHSA-gg57-587f-h5v6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nZzU3LTU4N2YtaDV2Ns4AA429
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 11 months ago
Updated: 3 days ago

CVSS Score: 2.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-gg57-587f-h5v6, CVE-2023-5384
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-5384
• https://access.redhat.com/errata/RHSA-2023:7676
• https://access.redhat.com/security/cve/CVE-2023-5384
• https://bugzilla.redhat.com/show_bug.cgi?id=2242156
• https://security.netapp.com/advisory/ntap-20240125-0004
• https://github.com/infinispan/infinispan/pull/11555
• https://github.com/infinispan/infinispan/pull/11995
• https://github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47
• https://github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61
• https://issues.redhat.com/browse/ISPN-15202
• https://github.com/advisories/GHSA-gg57-587f-h5v6

Repository: https://github.com/infinispan/infinispan
Blast Radius: 9.7

Affected Packages