CVE-2025-5731
Fixed in a distro release EPSS <1%CVSS 5.5
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
Products: Red Hat Infinispan, Red Hat Data Grid 8.5.4, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.infinispan:infinispan-cli-client | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | infinispan-15.0 | no fix |
| Chainguard | infinispan-15.1 | no fix |
| Chainguard | infinispan-15.2 | no fix |
| Chainguard | infinispan-16.0 | 16.0.5-r0 |
| Chainguard | infinispan-16.1 | 16.1.0-r0 |
| Chainguard | infinispan-16.2 | 0 |
| Wolfi | infinispan-16.0 | 16.0.5-r0 |
| Wolfi | infinispan-16.1 | 16.1.0-r0 |
| Wolfi | infinispan-16.2 | 0 |