RESTEasy Information Disclosure

The vulnerability of the RESTEasy software is related to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to disclose the protected information remotely...

Cross-Site Scripting (XSS)

resteasy is vulnerable to cross-site scripting. The vulnerability exists because the encoding is not properly handled which allows an attacker to inject and execute arbitrary javascript...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.5.10 update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

Privilege Escalation

io.quarkus.resteasy.reactive:resteasy-reactive-vertx is vulnerable to privilege escalation. A low-privileged attacker is able to perform unauthorized operations on the database due to a permissions leak on web requests, which allows the attacker to elevate privileges...

CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

Design/Logic Flaw

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

com.ibm.research.kar:kar-runtime-quarkus (>=1.0.9, <=1.3.5), io.automatiko.addons:automatiko-files-filesystem-addon (>=0.9.0, <=0.13.0) +50 more potentially affected by CVE-2022-0981 via io.quarkus.resteasy.reactive:resteasy-reactive-vertx (>=1.11.0.beta1, <=2.7.0.final)

io.quarkus.resteasy.reactive:resteasy-reactive-vertx MAVEN version =1.11.0.beta1, =1.0.9, =0.9.0, =0.9.0, =0.9.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.0.2, =0.0.9 - io.javaoperatorsdk.admissioncontroller.sample:quarkus-sample 0.2.0 -...

CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

CVE-2022-0981

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

RESTEasy: PathParam in RESTEasy can lead to a reflected XSS attack

A reflected Cross-Site Scripting XSS flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The...

Important: Red Hat Security Advisory: Red Hat Integration Camel-K 1.6.4 release and security update

A micro version update from 1.6.3 to 1.6.4 is now available for Red Hat Integration Camel K that includes bug fixes and enhancements. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a...

Quarkus security vulnerabilities

Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus, which stems from the fact that in RestEasy Reactive, state and possibly associated permissions may leak from one web request to another. The vulnerability allows a...

CVE-2022-0981: Incorrect Authorization

A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended...

PT-2022-13570

Name of the Vulnerable Software and Affected Versions Quarkus affected versions not specified Description A flaw in Quarkus allows the state and potentially associated permissions to leak from one web request to another in RestEasy Reactive. This issue enables a low-privileged user to perform...

com.wavefront:proxy (>=11.0-rc3, <=11.0) potentially affected by CVE-2020-14326 via org.jboss.resteasy:resteasy-bom (3.13.2.final)

org.jboss.resteasy:resteasy-bom MAVEN version 3.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-bom and may be impacted: - com.wavefront:proxy =11.0-rc3, =11.0 Source cves: CVE-2020-14326 Source advisory:...

RESTEasy 4.5.5.Final in hash flooding

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service...

GHSA-37G7-8VJJ-PJPJ RESTEasy 4.5.5.Final in hash flooding

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service...