CVE-2019-10174

Fixed in a distro release EPSS 3%CVSS 7.5

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

Published 2019-11-25 · CVE record · OSV

Products: infinispan, redhat fuse, redhat jboss_data_grid, redhat jboss_enterprise_application_platform, redhat openshift_application_runtimes, redhat single_sign-on, netapp active_iq_unified_manager

Fixed upstream

Ecosystem	Package	Fixed in
Maven	org.infinispan:infinispan-core	8.2.12.Final
Maven	org.infinispan:infinispan-core	9.4.17.Final

Distro releases

Release	Package	Fixed in
Red Hat jboss enterprise application platform 7.2	eap7-glassfish-jsf	0:2.3.5-11.SP3_redhat_00009.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-glassfish-jsf	0:2.3.5-11.SP3_redhat_00009.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-glassfish-jsf	0:2.3.5-11.SP3_redhat_00009.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-cachestore-jdbc	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-cachestore-jdbc	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-cachestore-jdbc	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-cachestore-remote	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-cachestore-remote	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-cachestore-remote	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-client-hotrod	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-client-hotrod	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-client-hotrod	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-commons	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-commons	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-commons	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-core	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-core	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-core	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-commons	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-commons	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-commons	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-spi	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-spi	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-spi	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-v53	0:9.3.9-1.Final_redhat_00001.1.el7eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-v53	0:9.3.9-1.Final_redhat_00001.1.el6eap
Red Hat jboss enterprise application platform 7.2	eap7-infinispan-hibernate-cache-v53	0:9.3.9-1.Final_redhat_00001.1.el8eap
Red Hat jboss enterprise application platform eus 7.1	eap7-apache-commons-beanutils	0:1.9.4-1.redhat_00002.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-infinispan	0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-infinispan-cachestore-jdbc	0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-infinispan-cachestore-remote	0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-infinispan-client-hotrod	0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-infinispan-commons	0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-infinispan-core	0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-jackson-databind	0:2.8.11.5-1.redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-log4j-jboss-logmanager	0:1.2.2-1.Final_redhat_00002.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-netty	0:4.1.45-1.Final_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-netty-all	0:4.1.45-1.Final_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-undertow	0:1.4.18-12.SP12_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-wildfly	0:7.1.7-2.GA_redhat_00002.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-wildfly-elytron	0:1.1.13-1.Final_redhat_00001.1.ep7.el7
Red Hat jboss enterprise application platform eus 7.1	eap7-wildfly-modules	0:7.1.7-2.GA_redhat_00002.1.ep7.el7