Red Hat Security AdvisoryRHSA-2018:0294
Red Hat JBoss Data Grid 7.1.2 security update
Released 2018-02-12 · Red Hat rating Important · View on Red Hat →
Fixes 3 records
Priority HIGH 75
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to t…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.37721 · Published 2018-02-06 · Partial fix · 2.6.7.1, 2.7.9.1 +1 CWE-184
Priority MEDIUM 43
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02827 · Published 2018-02-15 · Partial fix · 9.2.0.CR1 CWE-502
Priority LOW 37
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02366 · Published 2017-05-21 · Partial fix · 1.9.2 CWE-200
