Read the docs
TI-2019-07479 Aliases CVE-2019-10158GHSA-6x3v-rw2q-9gx7

Session fixation in Red Hat infinispan

Priority MEDIUM 46CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-384.

Summary

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

Why it matters now

EPSS 0.01957 80th percentileScored 2026-11-07
Fix Fixed org.infinispan:infinispan-core (Maven): 9.4.15.FinalRed Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatinfinispanall versions—No fix listedCNA
—org.infinispan:infinispan-core (Maven)before 9.4.15.Final9.4.15.FinalPatch availableGHSA-6x3v-rw2q-9gx7
  • infinispan VendorRed Hat Affected all versions Fixed in — No fix listed CNA
  • org.infinispan:infinispan-core (Maven) Vendor— Affected before 9.4.15.Final Fixed in 9.4.15.Final Patch available GHSA-6x3v-rw2q-9gx7

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*up to 9.4.14VulnerableInfinispan
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
  • cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:* Versions up to 9.4.14 Vulnerable ·Infinispan
  • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-6x3v-rw2q-9gx7 org.infinispan:infinispan-core (Maven) Fixed in 9.4.15.Final Advisory →

Red Hat 1 advisory

  • RHSA-2019:4037 Released 2019-12-02 · Red Hat rating Important
    Red Hat Data Grid 7.3.2 security update
    • Red Hat Data Grid

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Data GridFixed RHSA-2019:4037
Not affected: 13 products
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 14 (Rocky)
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10158
  2. 2026-10-03 Alias added: GHSA-6x3v-rw2q-9gx7

References

Patch 1

Advisory 3

Other 6

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2022-01156 Improper input validation in gzip, xz-utils CVSS 3.1HIGH 8.8
  • TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
  • TI-2019-07532 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences