4.2
Medium
CVE-2016-0750 The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain…
Description
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Infinispan | 9.1.0.Final | No fix stated |
References
- issues.jboss.org issues.jboss.org
- 101910 www.securityfocus.com
- github.com github.com
- RHSA-2018:0501 access.redhat.com
- RHSA-2017:3244 access.redhat.com
- bugzilla.redhat.com bugzilla.redhat.com
Timeline
- Published
- Last modified