CVE-2023-4586

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2023:7676
https://access.redhat.com/security/cve/CVE-2023-4586	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2235564	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:infinispan:hot_rod:-:*:*:*:*:*:*:*

History

06 Dec 2023, 22:15

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2023:7676 -

01 Dec 2023, 14:49

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-04 11:15

Updated : 2024-02-05 00:01

NVD link : CVE-2023-4586

Mitre link : CVE-2023-4586

CVE.ORG link : CVE-2023-4586

JSON object : View

Products Affected

infinispan

hot_rod

redhat

data_grid

CWE

CWE-295

Improper Certificate Validation

CWE-20

Improper Input Validation

{"id": "CVE-2023-4586", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2023-10-04T11:15:10.500", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:7676", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4586", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235564", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el cliente Hot Rod. Este problema de seguridad ocurre porque el cliente Hot Rod no habilita la validaci\u00f3n del nombre de host cuando usa TLS, lo que posiblemente resulte en un ataque de man-in-the-middle (MITM)."}], "lastModified": "2023-12-06T22:15:06.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3311F2A9-C028-4765-BF79-BC370D15550C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:infinispan:hot_rod:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B99E1E2-CFB8-4B3A-80FE-32AEF0D1CB5A"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}