CVE-2023-4586

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2023:7676
https://access.redhat.com/security/cve/CVE-2023-4586	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2235564	Issue Tracking Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7676
https://access.redhat.com/security/cve/CVE-2023-4586	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2235564	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:infinispan:hot_rod:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:35

Type	Values Removed	Values Added
References	~~() https://access.redhat.com/errata/RHSA-2023:7676 -~~	() https://access.redhat.com/errata/RHSA-2023:7676 -
References	~~() https://access.redhat.com/security/cve/CVE-2023-4586 - Third Party Advisory~~	() https://access.redhat.com/security/cve/CVE-2023-4586 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2235564 - Issue Tracking, Third Party Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2235564 - Issue Tracking, Third Party Advisory

06 Dec 2023, 22:15

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2023:7676 -

01 Dec 2023, 14:49

Type	Values Removed	Values Added
CPE	cpe:2.3:a:netty:netty::::::::

Information

Published : 2023-10-04 11:15

Updated : 2024-11-21 08:35

NVD link : CVE-2023-4586

Mitre link : CVE-2023-4586

CVE.ORG link : CVE-2023-4586

JSON object : View

Products Affected

redhat

data_grid

infinispan

hot_rod

CWE

CWE-20

Improper Input Validation

CWE-295

Improper Certificate Validation

{"id": "CVE-2023-4586", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2023-10-04T11:15:10.500", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:7676", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4586", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235564", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7676", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-4586", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235564", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en el cliente Hot Rod. Este problema de seguridad ocurre porque el cliente Hot Rod no habilita la validaci\u00f3n del nombre de host cuando usa TLS, lo que posiblemente resulte en un ataque de man-in-the-middle (MITM)."}], "lastModified": "2024-11-21T08:35:29.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3311F2A9-C028-4765-BF79-BC370D15550C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:infinispan:hot_rod:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B99E1E2-CFB8-4B3A-80FE-32AEF0D1CB5A"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}