title: Red Hat Security Advisory: Red Hat Data Grid 8.2.0 security update
description: infinispan-server-rest: Actions with effects should not be permitted via GET requests using REST API XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling XStream: arbitrary file deletion on the local host when unmarshalling netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream XStream: SSRF via crafted input stream XStream: arbitrary file deletion on the local host via crafted input stream XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator XStream: ReDoS vulnerability XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream netty: Request smuggling via content-length header Infinispan: Authentication bypass on REST endpoints when using DIGEST authentication mechanism
cpes: cpe:/a:redhat:jboss_data_grid:8