{"id":"CVE-2017-15089","details":"It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.","aliases":["GHSA-46r5-59fg-2fjc"],"modified":"2026-08-18T09:55:33.907686Z","published":"2018-02-15T17:29:00.207Z","references":[{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1040360"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0294"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0478"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0479"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0480"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0481"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0501"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:1326"},{"type":"FIX","url":"https://github.com/infinispan/infinispan/pull/5639"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/infinispan/infinispan","events":[{"introduced":"0"},{"last_affected":"268ed3e7b97455765d1c99d2077fa2ba7033c090"},{"introduced":"b09f4e12a13afbbd33e5248f7d119008f49d961b"},{"last_affected":"504f165a5b57383e63bf07255692980c5b047bb2"}],"database_specific":{"cpe":["cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*","cpe:2.3:a:infinispan:infinispan:9.2.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:infinispan:infinispan:9.2.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:infinispan:infinispan:9.2.0:beta1:*:*:*:*:*:*","cpe:2.3:a:infinispan:infinispan:9.2.0:beta2:*:*:*:*:*:*","cpe:2.3:a:infinispan:infinispan:9.2.0:cr1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"9.1.6"},{"introduced":"9.2.0-alpha1"},{"last_affected":"9.2.0-alpha1"},{"introduced":"9.2.0-alpha2"},{"last_affected":"9.2.0-alpha2"},{"introduced":"9.2.0-beta1"},{"last_affected":"9.2.0-beta1"},{"introduced":"9.2.0-beta2"},{"last_affected":"9.2.0-beta2"},{"introduced":"9.2.0-cr1"},{"last_affected":"9.2.0-cr1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["9.2.0-alpha1","9.2.0-alpha2","9.2.0-beta1","9.2.0-beta2","9.2.0-cr1","9.1.6.Final","9.2.0.CR1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-15089.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}