Is CVE-2016-0750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-0750 being exploited in the wild.

How severe is CVE-2016-0750?

High severity, with a CVSS score of 8.8, published 13 May 2022.

Which products and versions are affected?

Infinispan Hot Rod Java Client < 9.1.0.Final; org.infinispan:infinispan-core (Maven) < 9.1.0.Final, ECOSYSTEM:introduced=0,fixed=9.1.0.Final.

Is there a fix for CVE-2016-0750?

Yes. org.infinispan:infinispan-core (Maven): upgrade to 9.1.0.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-0750 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-0750?

Check whether you run Infinispan Hot Rod Java Client or org.infinispan:infinispan-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-0750: Infinispan Hot Rod Java client insecure deserialization

Q: Is there a fix for CVE-2016-0750?

Yes. org.infinispan:infinispan-core (Maven): upgrade to 9.1.0.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2016-0750 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2016-0750?

Check whether you run Infinispan Hot Rod Java Client or org.infinispan:infinispan-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-0750 · Severity: high · CVSS 8.8 · Published 2022-05-13

Infinispan is a distributed in-memory data grid used for high-performance data storage and caching. A security vulnerability in its Java client allows a malicious user to execute unauthorized code on systems using the client. This could lead to a full system takeover, data theft, or service disruption. Organizations should update to version 9.1.0.Final or later to resolve this issue.

Technologies: org.infinispan:infinispan-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2016-0750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-0750 being exploited in the wild.
How severe is CVE-2016-0750?: High severity, with a CVSS score of 8.8, published 13 May 2022.
Which products and versions are affected?: Infinispan Hot Rod Java Client < 9.1.0.Final; org.infinispan:infinispan-core (Maven) < 9.1.0.Final, ECOSYSTEM:introduced=0,fixed=9.1.0.Final.
Is there a fix for CVE-2016-0750?: Yes. org.infinispan:infinispan-core (Maven): upgrade to 9.1.0.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-0750 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-0750?: Check whether you run Infinispan Hot Rod Java Client or org.infinispan:infinispan-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.infinispan:infinispan-core (Maven): upgrade to 9.1.0.Final or later

# set org.infinispan:infinispan-core to 9.1.0.Final in your pom.xml or build.gradle

Technical details

A deserialization vulnerability (CWE-502) exists in the Infinispan Hot Rod Java client's marshaller utility. The client automatically deserializes byte-array message contents during certain events without sufficient validation. An attacker with the ability to inject specially crafted serialized objects into the data stream can trigger the execution of arbitrary code in the context of the Java application. The fix, introduced in version 9.1.0.Final, implements a whitelist mechanism for Java deserialization to restrict which classes can be reconstructed from byte streams.

Affected products

Infinispan Infinispan Hot Rod Java Client < 9.1.0.Final

Identifiers

CVE-2016-0750
GHSA-4hhg-8ghq-vwq6

Timeline

2017-05-03: disclosed: Initial pull request for fix submitted
2017-06-08: patched: Fix merged into master branch
2018-09-11: advisory: NVD publication date
2022-05-13: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.