CVE-2025-0736

Overview

Infinispan is an open-source in-memory data grid and distributed key/value data store. Java applications embed it as a local or clustered cache through infinispan-core, or connect to a cluster of Infinispan Server nodes through the Java Hot Rod client, infinispan-client-hotrod. Its modules are published to Maven Central under org.infinispan, and Spring Boot 2.7 manages the Infinispan 13.0 BOM.

An information exposure vulnerability (CVE-2025-0736) has been identified in Infinispan's JGroups cluster transport, which allows attackers with access to application logs to read sensitive configuration details, such as the database username and password of a JDBC_PING discovery protocol, when the JGroups channel cannot be created.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Infinispan.

Details

Module Info

• Product: Infinispan
• Affected packages: org.infinispan:infinispan-parent
• Affected versions: <14.0.34.Final, >=15.0.0.Dev01 <15.0.13.Final, >=15.1.0.Dev01 <15.1.5.Final
• GitHub repository: https://github.com/infinispan/infinispan
• Published packages: https://central.sonatype.com/artifact/org.infinispan/infinispan-parent
• Package manager: Maven
• Fixed in:
  • OSS Infinispan 14.0.34.Final, 15.0.13.Final, 15.1.5.Final, 15.2.0.Final
  • NES for Infinispan v13.0.24

Vulnerability Info

This Medium-severity vulnerability is found in the org.infinispan:infinispan-parent package in multiple versions of Infinispan. The affected code is the JGroups cluster transport, JGroupsTransport, which ships in the infinispan-core module. When a clustered cache manager starts, the transport asks its channel configurator to create the JGroups channel. If channel creation fails, the transport wraps the failure in an exception whose message is built from the configurator's full protocol stack string:

private void channelFromConfigurator(JGroupsChannelConfigurator configurator) {
   ...
   try {
      channel = configurator.createChannel(configuration.transport().clusterName());
   } catch (Exception e) {
      throw CLUSTER.errorCreatingChannelFromConfigurator(configurator.getProtocolStackString(), e);
   }
}

EmbeddedJGroupsChannelConfigurator.getProtocolStackString() returns getProtocolStack().toString(), and each JGroups ProtocolConfiguration renders as its protocol name followed by every configured property and its value. The resulting message, Error while trying to create a channel using the specified configuration '%s', therefore contains the full configuration of every protocol in the stack. When the stack uses the JDBC_PING discovery protocol, that includes its connection_username and connection_password properties, so the database credentials are written in plaintext to the exception message and to any log that records it. Anyone who can read those logs, or an exception reported to a monitoring system, obtains the credentials. The exposure requires a clustered configuration that uses JGroups with JDBC_PING and a failure while creating the channel.

Mitigation

Infinispan's security policy lists only its current release lines as supported for vulnerability updates, and upstream has made no 13.0.x release since 13.0.22.Final (April 2024), so no 13.0.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Infinispan that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Vika Vorkin (finder)