CVE-2018-1131: Deserialization of Untrusted Data

May 13, 2022 (updated June 29, 2022)

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

References

www.securityfocus.com/bid/104218
access.redhat.com/errata/RHSA-2018:1833
access.redhat.com/errata/RHSA-2019:3892
bugzilla.redhat.com/show_bug.cgi?id=1576492
github.com/advisories/GHSA-qqfc-m9hc-pqv3
nvd.nist.gov/vuln/detail/CVE-2018-1131

Code Behaviors & Features

Detect and mitigate CVE-2018-1131 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →