CVE-2019-10158
published 2020-01-02CVE-2019-10158: A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration…
PriorityP344critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.96%
78.0th percentile
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| infinispan | infinispan | <= 9.4.14 | — |
| red_hat | infinispan | — | — |
| redhat | jboss_data_grid | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
infinispan: Session fixation protection broken for Spring Session integration
vendor_redhat·2019-05-23·CVSS 9.8
CVE-2019-10158 [CRITICAL] CWE-384 infinispan: Session fixation protection broken for Spring Session integration
infinispan: Session fixation protection broken for Spring Session integration
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
Package: infinispan (Red Hat Decision Manager 7) - Not affected
Package: camel (Red Hat Fuse 7) - Not affected
Package: infinispan (Red Hat JBoss Data Virtualization 6) - Not affected
Package: infinispan (Red Hat JBoss Enterprise Application Platform 6) - Not affected
Package: infinispan (Red Hat JBoss Enterprise Ap
OSV
Improper implementation of the session fixation protection in Infinispan
osv·2020-01-21
CVE-2019-10158 [CRITICAL] Improper implementation of the session fixation protection in Infinispan
Improper implementation of the session fixation protection in Infinispan
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
GHSA
Improper implementation of the session fixation protection in Infinispan
ghsa·2020-01-21
CVE-2019-10158 [CRITICAL] CWE-384 Improper implementation of the session fixation protection in Infinispan
Improper implementation of the session fixation protection in Infinispan
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10158 infinispan: Session fixation protection broken for Spring Session integration
bugzilla·2019-05-27·CVSS 9.8
CVE-2019-10158 [CRITICAL] CVE-2019-10158 infinispan: Session fixation protection broken for Spring Session integration
CVE-2019-10158 infinispan: Session fixation protection broken for Spring Session integration
A vulnerability was found in Infinispan up to version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration may result in an incorrect session handling
Referrences:
https://issues.jboss.org/browse/ISPN-10224
Upstream Patch:
https://github.com/infinispan/infinispan/pull/6960
Discussion:
Created infinispan tracking bugs for this issue:
Affects: fedora-all [bug 1714360]
---
Red Hat OpenStack - OpenDaylight
This vulnerability is within org.infinispan.spring.common.session which is not included in OpenDaylight.
---
The following products are marked as notaffected because they do not contain the vulnerable library.
* Enterprise Applicatio
arXiv
A Review on C3I Systems' Security: Vulnerabilities, Attacks, and Countermeasures
arxiv_fulltext·2022-01-31
A Review on C3I Systems' Security: Vulnerabilities, Attacks, and Countermeasures
A Review on C3I Systems' Security: Vulnerabilities, Attacks, and Countermeasures
Hussain Ahmad
[email protected]
CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, CSCRC - Cyber Security Cooperative Research Centre
Australia
Isuru Dharmadasa
[email protected]
Faheem Ullah
[email protected]
CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide
Australia
M. Ali Babar
[email protected]
CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, CSCRC - Cyber Security Cooperative Research Centre
Australia
Authors' addresses: Hussain Ahmad, [email protected]; Isuru Dharmadasa, isuru.mahaganiarach
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158https://github.com/infinispan/infinispan/pull/6960https://github.com/infinispan/infinispan/pull/7025https://security.netapp.com/advisory/ntap-20231227-0009/https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158https://github.com/infinispan/infinispan/pull/6960https://github.com/infinispan/infinispan/pull/7025https://security.netapp.com/advisory/ntap-20231227-0009/
2020-01-02
Published