CVE-2016-0750 Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

What is CVE-2016-0750?

CVE-2016-0750 is a medium-severity unsafe deserialization vulnerability in Red Hat Infinispan, published on 11 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

Weakness: CWE-502, CWE-138

Which versions are affected by CVE-2016-0750?

2 open source packages ship an affected version, including org.infinispan:infinispan-core. It affects 1 product.

Products include Infinispan Infinispan.

How do I fix CVE-2016-0750?

Upgrade org.infinispan:infinispan-core to 9.1.0.Final or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2016-0750 being exploited?

There is no known exploitation of CVE-2016-0750 in the wild and no public exploit code.

Other vulnerabilities in Red Hat Infinispan

• CVE-2018-1131 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2017-15089 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2019-10174 Use of Externally-Controlled Input to Select Classes or Code in Infinispan High 7.5
• CVE-2023-5384 Infinispan: credentials returned from configuration as clear text High 7.2
• CVE-2023-3628 Infispan: rest bulk ops don't check permissions Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4hhg-8ghq-vwq6.