CVE-2023-5384: Infinispan caches credentials in clear text
(updated )
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
References
- access.redhat.com/errata/RHSA-2023:7676
- access.redhat.com/security/cve/CVE-2023-5384
- bugzilla.redhat.com/show_bug.cgi?id=2242156
- github.com/advisories/GHSA-gg57-587f-h5v6
- github.com/infinispan/infinispan
- github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47
- github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61
- github.com/infinispan/infinispan/pull/11555
- github.com/infinispan/infinispan/pull/11995
- issues.redhat.com/browse/ISPN-15202
- nvd.nist.gov/vuln/detail/CVE-2023-5384
- security.netapp.com/advisory/ntap-20240125-0004
Code Behaviors & Features
Detect and mitigate CVE-2023-5384 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →