GitHub Advisoryadvisory · Maven

GHSA-gg57-587f-h5v6 Infinispan caches credentials in clear text

MEDIUM Published 2023-12-28 Modified 2024-11-18 Official page ↗
Aliases
CVE-2023-5384
Ecosystem
Maven
Packages
org.infinispan:infinispan-core, org.infinispan:infinispan-commons, org.infinispan:infinispan-hotrod, org.infinispan:infinispan-client-hotrod, org.infinispan:infinispan-cachestore-jdbc-common, org.infinispan:infinispan-cachestore-remote, org.infinispan:infinispan-cachestore-sql, org.infinispan:infinispan-cachestore-jdbc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2024-09-16

Affected packages

• Maven org.infinispan:infinispan-core: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-core: < 14.0.25.Final → fixed in 14.0.25.Final • Maven org.infinispan:infinispan-commons: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-commons: < 14.0.25.Final → fixed in 14.0.25.Final • Maven org.infinispan:infinispan-hotrod: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-hotrod: < 14.0.25.Final → fixed in 14.0.25.Final • Maven org.infinispan:infinispan-client-hotrod: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-client-hotrod: < 14.0.25.Final → fixed in 14.0.25.Final • Maven org.infinispan:infinispan-cachestore-jdbc-common: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-cachestore-jdbc-common: < 14.0.25.Final → fixed in 14.0.25.Final • Maven org.infinispan:infinispan-cachestore-remote: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-cachestore-remote: < 14.0.25.Final → fixed in 14.0.25.Final • Maven org.infinispan:infinispan-cachestore-sql: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-cachestore-sql: < 14.0.25.Final → fixed in 14.0.25.Final • Maven org.infinispan:infinispan-cachestore-jdbc: >= 15.0.0.Dev01, < 15.0.0.Dev07 → fixed in 15.0.0.Dev07 • Maven org.infinispan:infinispan-cachestore-jdbc: < 14.0.25.Final → fixed in 14.0.25.Final

Description

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References