CVE-2023-5384 Infinispan: credentials returned from configuration as clear text

What is CVE-2023-5384?

CVE-2023-5384 is a high-severity vulnerability in Red Hat Data Grid 8.4.6, published on 18 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

Weakness: CWE-312

Which versions are affected by CVE-2023-5384?

32 open source packages ship an affected version, including org.infinispan:infinispan-cachestore-jdbc, org.infinispan:infinispan-cachestore-jdbc-common and org.infinispan:infinispan-cachestore-remote. It affects 3 products.

Products include Infinispan Infinispan, Redhat Data Grid, Redhat Jboss Data Grid.

How do I fix CVE-2023-5384?

Upgrade org.infinispan:infinispan-cachestore-jdbc to a fixed version for your release line: 14.0.25.Final or 15.0.0.Dev07.

Is CVE-2023-5384 being exploited?

There is no known exploitation of CVE-2023-5384 in the wild and no public exploit code.

Other vulnerabilities in Red Hat Data Grid 8.4.6

• CVE-2018-1131 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2017-15089 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2019-10174 Use of Externally-Controlled Input to Select Classes or Code in Infinispan High 7.5
• CVE-2023-3628 Infispan: rest bulk ops don't check permissions Medium 6.5
• CVE-2020-25711 Improper Access Control in infinispan-server-runtime Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gg57-587f-h5v6.