Red Hat Data Grid
Recent Red Hat Data Grid Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2023:1303 | (RHSA-2023:1303) Important: Red Hat Data Grid 7.3.10 security update | March 17, 2023 |
| RHSA-2023:0713 | (RHSA-2023:0713) Important: Red Hat Data Grid 8.4.1 security update | February 9, 2023 |
| RHSA-2022:8524 | (RHSA-2022:8524) Important: Red Hat Data Grid 8.4.0 security update | November 17, 2022 |
| RHSA-2022:2232 | (RHSA-2022:2232) Moderate: Red Hat Data Grid 8.3.1 security update | May 12, 2022 |
| RHSA-2022:0520 | (RHSA-2022:0520) Moderate: Red Hat Data Grid 8.3.0 security update | February 14, 2022 |
| RHSA-2022:0430 | (RHSA-2022:0430) Important: Red Hat Data Grid 7.3.9 security update | February 3, 2022 |
| RHSA-2022:0205 | (RHSA-2022:0205) Moderate: Red Hat Data Grid 8.2.3 security update | January 20, 2022 |
| RHSA-2021:5132 | (RHSA-2021:5132) Critical: Red Hat Data Grid 8.2.2 security update | December 14, 2021 |
| RHSA-2021:2139 | (RHSA-2021:2139) Critical: Red Hat Data Grid 8.2.0 security update | May 27, 2021 |
By the Year
In 2023 there have been 0 vulnerabilities in Red Hat Data Grid . Data Grid did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 4 | 6.75 |
| 2020 | 2 | 7.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Data Grid vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Data Grid Security Vulnerabilities
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0)
CVE-2021-31917
9.8 - Critical
- September 21, 2021
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
authentification
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final
CVE-2021-3642
5.3 - Medium
- August 05, 2021
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
Side Channel Attack
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests
CVE-2020-10771
7.1 - High
- June 02, 2021
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.
Session Riding
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode
CVE-2021-3536
4.8 - Medium
- May 20, 2021
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
XSS
A flaw was found in infinispan 10 REST API
CVE-2020-25711
6.5 - Medium
- December 03, 2020
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
AuthZ
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session
CVE-2020-25644
7.5 - High
- October 06, 2020
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
Memory Leak
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3
CVE-2015-7501
9.8 - Critical
- November 09, 2017
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Marshaling, Unmarshaling
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Xpaas or by Red Hat? Click the Watch button to subscribe.
