Deserialization of untrusted data in Red Hat infinispan
Priority MEDIUM 40CWE-349Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 5 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Why it matters now
EPSS 0.01186 68th percentileScored 2026-11-07
Fix Partial org.infinispan:infinispan-core (Maven): 9.3.1.FinalRed Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | infinispan | 9.0.3.Final; 9.1.7.Final; 8.2.10.Final; 9.2.2.Final; 9.3.0.Alpha1 | — | No fix listed | CNA |
| — | org.infinispan:infinispan-core (Maven) | — | — | No fix listed | GHSA-qqfc-m9hc-pqv3 |
| — | org.infinispan:infinispan-core (Maven) | — | — | No fix listed | GHSA-qqfc-m9hc-pqv3 |
| — | org.infinispan:infinispan-core (Maven) | — | — | No fix listed | GHSA-qqfc-m9hc-pqv3 |
| — | org.infinispan:infinispan-core (Maven) | — | — | No fix listed | GHSA-qqfc-m9hc-pqv3 |
| — | org.infinispan:infinispan-core (Maven) | 9.3.0.Alpha1 to before 9.3.1.Final | 9.3.1.Final | Patch available | GHSA-qqfc-m9hc-pqv3 |
- infinispan VendorRed Hat Affected 9.0.3.Final; 9.1.7.Final; 8.2.10.Final; 9.2.2.Final; 9.3.0.Alpha1 Fixed in — No fix listed CNA
- org.infinispan:infinispan-core (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-qqfc-m9hc-pqv3
- org.infinispan:infinispan-core (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-qqfc-m9hc-pqv3
- org.infinispan:infinispan-core (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-qqfc-m9hc-pqv3
- org.infinispan:infinispan-core (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-qqfc-m9hc-pqv3
- org.infinispan:infinispan-core (Maven) Vendor— Affected 9.3.0.Alpha1 to before 9.3.1.Final Fixed in 9.3.1.Final Patch available GHSA-qqfc-m9hc-pqv3
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:infinispan:infinispan:8.2.10:*:*:*:*:*:*:* | 8.2.10 | Vulnerable | Infinispan |
| cpe:2.3:a:infinispan:infinispan:9.0.3:*:*:*:*:*:*:* | 9.0.3 | Vulnerable | Infinispan |
| cpe:2.3:a:infinispan:infinispan:9.1.7:*:*:*:*:*:*:* | 9.1.7 | Vulnerable | Infinispan |
| cpe:2.3:a:infinispan:infinispan:9.2.2:*:*:*:*:*:*:* | 9.2.2 | Vulnerable | Infinispan |
| cpe:2.3:a:infinispan:infinispan:9.3.0:alpha1:*:*:*:*:*:* | 9.3.0 alpha1 | Vulnerable | Infinispan |
| cpe:2.3:a:redhat:jboss_data_grid:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
- cpe:2.3:a:infinispan:infinispan:8.2.10:*:*:*:*:*:*:* Versions 8.2.10 Vulnerable ·Infinispan
- cpe:2.3:a:infinispan:infinispan:9.0.3:*:*:*:*:*:*:* Versions 9.0.3 Vulnerable ·Infinispan
- cpe:2.3:a:infinispan:infinispan:9.1.7:*:*:*:*:*:*:* Versions 9.1.7 Vulnerable ·Infinispan
- cpe:2.3:a:infinispan:infinispan:9.2.2:*:*:*:*:*:*:* Versions 9.2.2 Vulnerable ·Infinispan
- cpe:2.3:a:infinispan:infinispan:9.3.0:alpha1:*:*:*:*:*:* Versions 9.3.0 alpha1 Vulnerable ·Infinispan
- cpe:2.3:a:redhat:jboss_data_grid:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-qqfc-m9hc-pqv3 org.infinispan:infinispan-core (Maven) Fixed in 9.3.1.Final Advisory →
Red Hat 2 advisories
- RHSA-2019:3892 Released 2019-11-14 · Red Hat rating ImportantRed Hat Fuse 7.5.0 security update
- Red Hat Fuse 7.5.0
- RHSA-2018:1833 Released 2018-06-12 · Red Hat rating ImportantRed Hat JBoss Data Grid 7.2.1 security update
- Red Hat Data Grid
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix yet |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Data Grid | Fixed | RHSA-2018:1833 |
| Red Hat Fuse 7.5.0 | Fixed | RHSA-2019:3892 |
Not affected: 3 products
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Operations Network 3
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1131
- 2026-10-03 Alias added: GHSA-qqfc-m9hc-pqv3
References
More Red Hat Jboss Data Grid vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2022-01156 Improper input validation in gzip, xz-utils CVSS 3.1HIGH 8.8
- TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
- TI-2019-07532 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-1131 · CVE Program
- CVE-2018-1131 · NVD
- FIRST EPSS
- GHSA-qqfc-m9hc-pqv3 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1131 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences