CVE-2023-0482

In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...

Resteasy 安全漏洞

Red Hat Resteasy is a JAX-RS a Java programming language API specification implementation from Red Hat. A security vulnerability exists in Resteasy that originates from allowing users to create insecure temporary files...

CVE-2023-0481

In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to SQL injection due to PostgreSQL (CVE-2022-31197) and obtaining sensitive information due to RESTEasy (CVE-2020-25633)

Summary IBM i Modernization Engine for Lifecycle Integration platform component is vulnerable to SQL injection and obtaining sensitive information as described in the Vulnerability Details section. These components are used in IBM i Modernization Engine for Lifecycle Integration for infrastructur...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.7 security update

Red Hat Integration Camel Extensions for Quarkus 2.7 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System CVSS base score, whic...

Improper Input Validation in RESTEasy

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to...

GHSA-63CQ-PPQ8-CW6G Improper Input Validation in RESTEasy

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to...

HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

GHSA-XRH2-C3RM-35JR HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

new packages: resteasy

An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.0...

XML External Entity Reference in RESTEasy

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the 1 external-general-entities or 2 external-parameter-entities features, which allows remote attackers to conduct XML external entity XXE attacks via unspecified vectors...

GHSA-PC54-PCHM-XCW6 XML External Entity Reference in RESTEasy

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the 1 external-general-entities or 2 external-parameter-entities features, which allows remote attackers to conduct XML external entity XXE attacks via unspecified vectors...

Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

GHSA-VXHJ-3X7P-JXP5 Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...

GHSA-9XFC-J5MF-9W5P JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack

JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...

JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack

JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion XSSI attack...