Skip to content
Fencer Intel
high 8.8

CVE-2017-15089 json

Deserialization of Untrusted Data in Infinispan

published 2018-02-15 8 y ago modified 2026-06-17 4 mo ago also GHSA-46r5-59fg-2fjc , EUVD-2022-2317

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

Patch / fix

  • maven org.infinispan:infinispan-core 9.2.0.CR1
  • eap7-jboss-ec2-eap jboss enterprise application platform 7 7.1.1-3.1.GA_redhat_3.ep7.el6
  • eap7-jboss-ec2-eap jboss enterprise application platform 7.1 7.1.1-3.1.GA_redhat_3.ep7.el7
  • eap7-jboss-ec2-eap-samples jboss enterprise application platform 7 7.1.1-3.1.GA_redhat_3.ep7.el6
  • eap7-jboss-ec2-eap-samples jboss enterprise application platform 7.1 7.1.1-3.1.GA_redhat_3.ep7.el7
  • eap7-wss4j jboss enterprise application platform 7.1 2.1.11-1.redhat_1.1.ep7.el7
  • eap7-wildfly jboss enterprise application platform 7.1 7.1.1-4.GA_redhat_2.1.ep7.el7
  • eap7-narayana jboss enterprise application platform 7.1 5.5.31-1.Final_redhat_1.1.ep7.el7
  • eap7-resteasy jboss enterprise application platform 7.1 3.0.25-1.Final_redhat_1.1.ep7.el7

red hat advisories RHSA-2018:0481RHSA-2018:0480RHSA-2018:0479

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-15089 updated cvss 8.0

infinispan: Unsafe deserialization of malicious object injected into data cache

  • Red Hat JBoss Data Grid 6 infinispan-core
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 6 infinispan-core
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Fuse Integration Service 2 infinispan-core
    affected: no fix available
  • Red Hat JBoss Fuse Service Works 6 infinispan-core Red Hat JBoss Portal 6 infinispan-core
    affected: no fix planned “Will not fix”
  • Red Hat Single Sign-On 7 infinispan-core
    affected: no fix available
  • Red Hat Virtualization 4 ovirt-engine
    affected: no fix planned “Will not fix”
  • Red Hat Data Grid 7.1.2
    fixed: vendor fix RHSA-2018:0294
  • Red Hat Fuse 6.3
    fixed: vendor fix RHSA-2019:1326
show 6 more
  • Red Hat JBoss EAP 7.1
    fixed: vendor fix RHSA-2018:0478
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-wss4j 2.1.11-1.redhat_1.1.ep7.el6, eap7-wildfly 7.1.1-4.GA_redhat_2.1.ep7.el6, eap7-apache-cxf 3.1.13-1.redhat_1.1.ep7.el6, eap7-xml-security 2.0.9-1.redhat_1.1.ep7.el6, eap7-jackson-core 2.8.11-1.redhat_1.1.ep7.el6, eap7-undertow 1.4.18-4.SP2_redhat_1.1.ep7.el6, +126 more
    fixed: vendor fix RHSA-2018:0479
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-wss4j 2.1.11-1.redhat_1.1.ep7.el7, eap7-wildfly 7.1.1-4.GA_redhat_2.1.ep7.el7, eap7-apache-cxf 3.1.13-1.redhat_1.1.ep7.el7, eap7-xml-security 2.0.9-1.redhat_1.1.ep7.el7, eap7-jackson-core 2.8.11-1.redhat_1.1.ep7.el7, eap7-undertow 1.4.18-4.SP2_redhat_1.1.ep7.el7, +126 more
    fixed: vendor fix RHSA-2018:0481
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
    fixed: vendor fix RHSA-2020:2561
  • Red Hat Single Sign-On 7.2.1 zip
    fixed: vendor fix RHSA-2018:0501
  • Red Hat JBoss Data Virtualization 6 infinispan-core Red Hat JBoss Operations Network 3 infinispan-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.83% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.infinispan:infinispan-core
<9.2.0.CR1
9.2.0.CR1

Affected products

  • Infinispan infinispan

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.