4.4Medium
CVE-2023-5236Infinispan: circular reference on marshalling leads to dos
Description
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| infinispan | infinispan | — | |
| redhat | data grid | < 8.4.4 | |
| redhat | jboss data grid | — | |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | all versions | |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | all versions | |
| Red Hat | Red Hat build of Debezium 2 | all versions | |
| Red Hat | Red Hat build of Debezium 3 | all versions | |
| Red Hat | Red Hat build of Quarkus | all versions | |
| Red Hat | Red Hat Data Grid 8 | all versions | |
| Red Hat | Red Hat Data Grid 8.4.4 | — | |
| Red Hat | Red Hat Fuse 7 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | all versions | |
| Red Hat | Red Hat Process Automation 7 | all versions | |
| Red Hat | Red Hat Single Sign-On 7 | all versions |
References and patches
- RHSA-2023:5396 vendor-advisoryVendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-5236 vdb-entryVendor Advisory
- RHBZ#2240999 issue-trackingIssue Tracking
- https://security.netapp.com/advisory/ntap-20240125-0004/
CPE matches (NVD) (3)
cpe:2.3:a:redhat:data_grid:*:*:*:*:*:*:*:*< 8.4.4cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*cpe:2.3:a:infinispan:infinispan:-:*:*:*:*:*:*:*