CVE-2018-1131 Deserialization of Untrusted Data in Infinispan

What is CVE-2018-1131?

CVE-2018-1131 is a high-severity unsafe deserialization vulnerability in Red Hat, Inc. infinispan, published on 15 May 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

Weakness: CWE-502, CWE-349

Which versions are affected by CVE-2018-1131?

4 open source packages ship an affected version, including org.infinispan:infinispan-core. It affects 2 products.

Products include Infinispan Infinispan, Redhat Jboss Data Grid.

How do I fix CVE-2018-1131?

Upgrade org.infinispan:infinispan-core to 9.3.1.Final or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-1131 being exploited?

There is no known exploitation of CVE-2018-1131 in the wild and no public exploit code.

Other vulnerabilities in Red Hat, Inc. infinispan

• CVE-2017-15089 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2019-10174 Use of Externally-Controlled Input to Select Classes or Code in Infinispan High 7.5
• CVE-2023-5384 Infinispan: credentials returned from configuration as clear text High 7.2
• CVE-2023-3628 Infispan: rest bulk ops don't check permissions Medium 6.5
• CVE-2020-25711 Improper Access Control in infinispan-server-runtime Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qqfc-m9hc-pqv3.