CVE-2017-15089 Deserialization of Untrusted Data in Infinispan

What is CVE-2017-15089?

CVE-2017-15089 is a high-severity unsafe deserialization vulnerability in infinispan, published on 15 Feb 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

Weakness: CWE-502

Which versions are affected by CVE-2017-15089?

2 open source packages ship an affected version, including org.infinispan:infinispan-core. It affects 1 product.

Products include Infinispan Infinispan.

How do I fix CVE-2017-15089?

Upgrade org.infinispan:infinispan-core to 9.2.0.CR1 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2017-15089 being exploited?

There is no known exploitation of CVE-2017-15089 in the wild and no public exploit code.

Other vulnerabilities in infinispan

• CVE-2018-1131 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2019-10174 Use of Externally-Controlled Input to Select Classes or Code in Infinispan High 7.5
• CVE-2023-5384 Infinispan: credentials returned from configuration as clear text High 7.2
• CVE-2023-3628 Infispan: rest bulk ops don't check permissions Medium 6.5
• CVE-2020-25711 Improper Access Control in infinispan-server-runtime Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-46r5-59fg-2fjc.