resteasy security update

2016-11-2516:02:08

CentOS Project

lists.centos.org

0.005 Low

EPSS

Percentile

76.6%

JSON

CentOS Errata and Security Advisory CESA-2016:2604

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

It was discovered that under certain conditions RESTEasy could be forced to parse a request with SerializableProvider, resulting in deserialization of potentially untrusted data. An attacker could possibly use this flaw to execute arbitrary code with the permissions of the application using RESTEasy. (CVE-2016-7050)

Red Hat would like to thank Mikhail Egorov (Odin) for reporting this issue.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2016-November/029922.html

Affected packages:
resteasy-base
resteasy-base-atom-provider
resteasy-base-client
resteasy-base-jackson-provider
resteasy-base-javadoc
resteasy-base-jaxb-provider
resteasy-base-jaxrs
resteasy-base-jaxrs-all
resteasy-base-jaxrs-api
resteasy-base-jettison-provider
resteasy-base-providers-pom
resteasy-base-resteasy-pom
resteasy-base-tjws

Upstream details at:
https://access.redhat.com/errata/RHSA-2016:2604

OSVersionArchitecturePackageVersionFilename
CentOS7noarchresteasy-base< 3.0.6-4.el7resteasy-base-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-atom-provider< 3.0.6-4.el7resteasy-base-atom-provider-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-client< 3.0.6-4.el7resteasy-base-client-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-jackson-provider< 3.0.6-4.el7resteasy-base-jackson-provider-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-javadoc< 3.0.6-4.el7resteasy-base-javadoc-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-jaxb-provider< 3.0.6-4.el7resteasy-base-jaxb-provider-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-jaxrs< 3.0.6-4.el7resteasy-base-jaxrs-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-jaxrs-all< 3.0.6-4.el7resteasy-base-jaxrs-all-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-jaxrs-api< 3.0.6-4.el7resteasy-base-jaxrs-api-3.0.6-4.el7.noarch.rpm
CentOS7noarchresteasy-base-jettison-provider< 3.0.6-4.el7resteasy-base-jettison-provider-3.0.6-4.el7.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	7	noarch	resteasy-base	< 3.0.6-4.el7	resteasy-base-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-atom-provider	< 3.0.6-4.el7	resteasy-base-atom-provider-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-client	< 3.0.6-4.el7	resteasy-base-client-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-jackson-provider	< 3.0.6-4.el7	resteasy-base-jackson-provider-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-javadoc	< 3.0.6-4.el7	resteasy-base-javadoc-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-jaxb-provider	< 3.0.6-4.el7	resteasy-base-jaxb-provider-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-jaxrs	< 3.0.6-4.el7	resteasy-base-jaxrs-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-jaxrs-all	< 3.0.6-4.el7	resteasy-base-jaxrs-all-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-jaxrs-api	< 3.0.6-4.el7	resteasy-base-jaxrs-api-3.0.6-4.el7.noarch.rpm
CentOS	7	noarch	resteasy-base-jettison-provider	< 3.0.6-4.el7	resteasy-base-jettison-provider-3.0.6-4.el7.noarch.rpm