Patchwire CVEs, their patch status, and feeds to follow them

CVE-2023-3628

Fixed in a distro release EPSS <1%CVSS 6.5

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

Published 2023-12-18 · CVE record · OSV

Products: Red Hat Data Grid 8.4.4, Red Hat JBoss Enterprise Application Platform 6

Fixed upstream

EcosystemPackageFixed in
Mavenorg.infinispan:infinispan-server-rest15.0.0.Dev04
Mavenorg.infinispan:infinispan-server-rest14.0.18.Final

Distro releases

ReleasePackageFixed in
Chainguardinfinispan-15.015.0.21-r1
Chainguardinfinispan-15.0-compat15.0.21-r1
Chainguardinfinispan-15.0-images15.0.21-r1
Chainguardinfinispan-15.115.1.7-r3
Chainguardinfinispan-15.1-compat15.1.7-r3
Chainguardinfinispan-15.1-images15.1.7-r3
Chainguardinfinispan-15.215.2.6-r1
Chainguardinfinispan-15.2-compat15.2.6-r1
Chainguardinfinispan-15.2-images15.2.6-r1
Wolfiinfinispan-15.215.2.6-r1
Wolfiinfinispan-15.2-compat15.2.6-r1
Wolfiinfinispan-15.2-images15.2.6-r1