io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...

io.inkstand:inkstand-deployment-resteasy (>=0.1.1, <=0.1.2), io.inkstand:inkstand-http-undertow (>=0.1.1, <=0.1.2) +8 more potentially affected by CVE-2019-14888 via io.undertow:undertow-core (1.2.0.beta3)

io.undertow:undertow-core MAVEN version 1.2.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.inkstand:inkstand-deployment-resteasy =0.1.1, =0.1.1, =0.0.1, =0.0.1, =4.0.0, =1.0.0.alpha11,...

org.jboss.resteasy:resteasy-spring (>=3.9.0.final, <=4.3.1.final), org.jboss.resteasy:resteasy-spring-web (>=4.2.0.final, <=4.7.10.final) +4 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.0.14.release)

org.springframework:spring-web MAVEN version 5.0.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.jboss.resteasy:resteasy-spring =3.9.0.final, =4.2.0.final, =4.2.0.final, =4.3.1.final ...

quarkus: privilege escalation vulnerability with RestEasy Reactive scope leakage in Quarkus

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

new packages: resteasy

An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.0...

com.redhat.rhevm.api:rhevm-api (>=0.1-milestone, <=0.9-milestone1), com.redhat.rhevm.api:rhevm-api-cli-actions (0.9-milestone1) +30 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.0-beta-4)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.redhat.rhevm.api:rhevm-api =0.1-milestone, =0.1-milestone, =0.1-milestone,...

XML External Entity Reference in RESTEasy

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the 1 external-general-entities or 2 external-parameter-entities features, which allows remote attackers to conduct XML external entity XXE attacks via unspecified vectors...

org.jboss.resteasy:abdera-atom-provider (2.2-beta-1), org.jboss.resteasy:async-http-servlet-3.0 (2.2-beta-1) +14 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.2-beta-1)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.2-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.jboss.resteasy:abdera-atom-provider 2.2-beta-1 -...

com.logiclander.jaasmine:jaasmine-web (1.0.0), net.ju-n.bonita.connectors:bonita-qrcode-connector (0.2) +16 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (1.2.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 1.2.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.logiclander.jaasmine:jaasmine-web 1.0.0 -...

org.jboss.resteasy:abdera-atom-provider (1.2.rc1), org.jboss.resteasy:async-http-servlet-3.0 (1.2.rc1) +7 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (1.2.rc1)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 1.2.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.jboss.resteasy:abdera-atom-provider 1.2.rc1 - org.jboss.resteasy:async-http-servlet-3.0...

com.redhat.rhevm.api:rhevm-api (>=0.9-milestone8.3, <=1.0-rc1.7), com.redhat.rhevm.api:rhevm-api-common-jaxrs (>=0.9-milestone8.3, <=1.0-rc1.7) +34 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.1.0.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.1.0.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.redhat.rhevm.api:rhevm-api =0.9-milestone8.3, =0.9-milestone8.3, =0.9-milestone8.3,...

org.jboss.resteasy:abdera-atom-provider (2.2-rc-1), org.jboss.resteasy:async-http-servlet-3.0 (2.2-rc-1) +15 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.2-rc-1)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.2-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.jboss.resteasy:abdera-atom-provider 2.2-rc-1 - org.jboss.resteasy:async-http-servlet-3...

net.encomendaz:encomendaz-services-client (>=1.0.0, <=1.0.2), org.apache.isis.viewer:isis-viewer-restfulobjects-applib (1.0.0) +24 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.3.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.3.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - net.encomendaz:encomendaz-services-client =1.0.0, =1.0.2 -...

com.redhat.rhevm.api:rhevm-api (0.9-milestone2), com.redhat.rhevm.api:rhevm-api-cli-actions (0.9-milestone2) +29 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.0-rc1)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.redhat.rhevm.api:rhevm-api 0.9-milestone2 - com.redhat.rhevm.api:rhevm-api-cli-actions...

org.chtijbug.drools:guvnor-jaxb-entities (5.6.2.chtijbug), org.drools:guvnor-jaxb-entities (>=5.6.0.cr1, <=5.6.0.final) +18 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.2.3.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.2.3.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.chtijbug.drools:guvnor-jaxb-entities 5.6.2.chtijbug - org.drools:guvnor-jaxb-entities...

com.redhat.rhevm.api:rhevm-api (>=0.9-milestone2.1, <=0.9-milestone8.2), com.redhat.rhevm.api:rhevm-api-cli-actions (>=0.9-milestone2.1, <=0.9-milestone6.6) +34 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.0.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.0.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.redhat.rhevm.api:rhevm-api =0.9-milestone2.1, =0.9-milestone2.1, =0.9-milestone2.1,...

GHSA-PC54-PCHM-XCW6 XML External Entity Reference in RESTEasy

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the 1 external-general-entities or 2 external-parameter-entities features, which allows remote attackers to conduct XML external entity XXE attacks via unspecified vectors...

io.apiman:apiman-distro-db (>=1.2.0.beta1, <=1.2.1.final), io.apiman:apiman-distro-db-es (>=1.2.0.beta1, <=1.2.1.final) +141 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.3.10.final)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.3.10.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - io.apiman:apiman-distro-db =1.2.0.beta1, =1.2.0.beta1, =1.2.0.beta2, =1.2.0.beta2,...

com.redhat.rhevm.api:rhevm-api (1.0-rc1.3), com.redhat.rhevm.api:rhevm-api-common-jaxrs (1.0-rc1.3) +80 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (2.2.0.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 2.2.0.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - com.redhat.rhevm.api:rhevm-api 1.0-rc1.3 - com.redhat.rhevm.api:rhevm-api-common-jaxrs...

org.jboss.resteasy:abdera-atom-provider (1.1.ga), org.jboss.resteasy:async-http-servlet-3.0 (1.1.ga) +6 more potentially affected by CVE-2014-7839 via org.jboss.resteasy:resteasy-jaxrs (1.1.ga)

org.jboss.resteasy:resteasy-jaxrs MAVEN version 1.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - org.jboss.resteasy:abdera-atom-provider 1.1.ga - org.jboss.resteasy:async-http-servlet-3.0...