What is GHSA-gg57-587f-h5v6?

GHSA-gg57-587f-h5v6 is a security advisory published by GitHub Security Advisories with Medium severity. Infinispan caches credentials in clear text

Which CVE IDs does GHSA-gg57-587f-h5v6 cover?

GHSA-gg57-587f-h5v6 covers the following CVE IDs: CVE-2023-5384. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gg57-587f-h5v6?

GHSA-gg57-587f-h5v6 has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

Which products are affected by GHSA-gg57-587f-h5v6?

GHSA-gg57-587f-h5v6 affects 16 products, including: maven/org.infinispan:infinispan-core:\u003e= 15.0.0.Dev01, \u003c 15.0.0.Dev07; maven/org.infinispan:infinispan-core:\u003c 14.0.25.Final; maven/org.infinispan:infinispan-commons:\u003e= 15.0.0.Dev01, \u003c 15.0.0.Dev07; maven/org.infinispan:infinispan-commons:\u003c 14.0.25.Final; maven/org.infinispan:infinispan-hotrod:\u003e= 15.0.0.Dev01, \u003c 15.0.0.Dev07; and others — see the full list on the advisory page.

GHSA-gg57-587f-h5v6MediumCVSS 2.7

Infinispan caches credentials in clear text

Vendor

GitHub Security Advisories

Published

December 28, 2023

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2023-5384 →

📋 Description

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

🎯 Affected products16

maven/org.infinispan:infinispan-core:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-core:< 14.0.25.Final
maven/org.infinispan:infinispan-commons:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-commons:< 14.0.25.Final
maven/org.infinispan:infinispan-hotrod:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-hotrod:< 14.0.25.Final
maven/org.infinispan:infinispan-client-hotrod:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-client-hotrod:< 14.0.25.Final
maven/org.infinispan:infinispan-cachestore-jdbc-common:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-cachestore-jdbc-common:< 14.0.25.Final
maven/org.infinispan:infinispan-cachestore-remote:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-cachestore-remote:< 14.0.25.Final
maven/org.infinispan:infinispan-cachestore-sql:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-cachestore-sql:< 14.0.25.Final
maven/org.infinispan:infinispan-cachestore-jdbc:>= 15.0.0.Dev01, < 15.0.0.Dev07
maven/org.infinispan:infinispan-cachestore-jdbc:< 14.0.25.Final

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products16

🔗 References (11)