Read the docs
Red Hat Security Advisory

RHSA-2021:2139

Red Hat Data Grid 8.2.0 security update

Released 2021-05-26 · Red Hat rating Critical · View on Red Hat →

Fixed in

Fixes 18 records

TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

Priority HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400
TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

Priority HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

Priority HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

Priority HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04395 CVE-2021-21295 · GHSA-wm47-8v5p-wjpj

Possible request smuggling in HTTP/2 due missing validation

Priority MEDIUM 50

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.18891 Published 2021-03-09 Partial fix · 4.1.60.Final CWE-444
TI-2021-11905 CVE-2021-31917 · GHSA-gwqg-r7f7-jjw4

Improper authentication in Red Hat DataGrid and Infinispan

Priority MEDIUM 45

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01347 Published 2021-09-21 Fixed CWE-287
TI-2020-08666 CVE-2020-10771 · GHSA-84m7-cxq5-q9xc

Cross-site request forgery in Infinispan

Priority LOW 32

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00445 Published 2021-06-02 Fixed CWE-352