RHSA-2023:7676HighCVSS 7.4

Red Hat Security Advisory: Red Hat Data Grid 8.4.6 security update

Published
December 6, 2023
Last Modified
August 4, 2026

🔗 CVE IDs covered (3)

CVE-2023-4586 →CVE-2023-5384 →CVE-2023-31582 →

📋 Description

CVE-2023-4586 — hotrod-client: Hot Rod client does not enable hostname validation when using TLS that lead to a MITM attack CVE-2023-5384 — infinispan: Credentials returned from configuration as clear text CVE-2023-31582 — jose4j: Insecure iteration count setting

🎯 Affected products1

  • Red Hat Data Grid 8.4.6

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No current mitigation is yet available for this vulnerability Workaround: The issue's impact is limited because only users with administrator permissions can retrieve the cache configurations, and the recommended approach for connecting via JDBC is using the `datasource` configuration, which does not expose the database credentials. Workaround: No mitigation is currently available for this flaw.

🔗 References (6)