Executive brief
Infinispan is a distributed in-memory data grid used for high-performance data storage and caching. A security vulnerability in its Java client allows a malicious user to execute unauthorized code on systems using the client. This could lead to a full system takeover, data theft, or service disruption. Organizations should update to version 9.1.0.Final or later to resolve this issue.
Technical details
A deserialization vulnerability (CWE-502) exists in the Infinispan Hot Rod Java client's marshaller utility. The client automatically deserializes byte-array message contents during certain events without sufficient validation. An attacker with the ability to inject specially crafted serialized objects into the data stream can trigger the execution of arbitrary code in the context of the Java application. The fix, introduced in version 9.1.0.Final, implements a whitelist mechanism for Java deserialization to restrict which classes can be reconstructed from byte streams.
Affected products
- Infinispan Infinispan Hot Rod Java Client < 9.1.0.Final
Timeline
- 2017-05-03: disclosed: Initial pull request for fix submitted
- 2017-06-08: patched: Fix merged into master branch
- 2018-09-11: advisory: NVD publication date
- 2022-05-13: advisory: GitHub Advisory published