Bug 1879042 (CVE-2020-25633)
| Summary: | CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Ted Jongseok Won <jwon> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aboyko, ahenning, aileenc, akoufoud, alazarot, alee, almorale, anstephe, ascheel, asoldano, atangrin, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bibryam, bkearney, bmaxwell, brian.stansberry, btotty, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, dchen, dkreling, dosoudil, drieden, edewata, eleandro, eric.wittmann, etirelli, ganandan, ggaughan, gmalinko, gsmet, hhudgeon, ibek, iweiss, janstey, java-sig-commits, jawilson, jbalunas, jochrist, jpallich, jperkins, jross, jstastny, jwon, krathod, kverlaen, kwills, laurence.labonte, lgao, lthon, lzap, mkdineshprasanth, mmccune, mnovotny, msochure, msvehla, mszynkie, nmoumoul, nwallace, pantinor, pdrozd, pgallagh, pjindal, pmackay, pskopek, psotirop, puntogil, rchan, rguimara, rhcs-maint, rjerrido, rrajasek, rruss, rstancel, rsvoboda, rsynek, sbiarozk, sdaley, sdouglas, security-response-team, sguilhen, smaestri, sokeeffe, sthorger, tom.jenkinson, weli |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | resteasy 4.5.9.Final | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. This flaw allows client users to obtain the server's potentially sensitive information when the server receives the WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-01-25 16:46:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1914261, 1914262, 1914380 | ||
| Bug Blocks: | 1877356, 2014197 | ||
|
Description
Ted Jongseok Won
2020-09-15 10:03:13 UTC
Affected artifacts: https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-client/ https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-client-microprofile/ This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2021:0250 https://access.redhat.com/errata/RHSA-2021:0250 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Via RHSA-2021:0246 https://access.redhat.com/errata/RHSA-2021:0246 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Via RHSA-2021:0247 https://access.redhat.com/errata/RHSA-2021:0247 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2021:0248 https://access.redhat.com/errata/RHSA-2021:0248 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25633 This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2021:0295 https://access.redhat.com/errata/RHSA-2021:0295 This issue has been addressed in the following products: Red Hat build of Quarkus Via RHSA-2021:1004 https://access.redhat.com/errata/RHSA-2021:1004 This issue has been addressed in the following products: Red Hat Satellite 6.8 for RHEL 7 Via RHSA-2021:1313 https://access.redhat.com/errata/RHSA-2021:1313 This issue has been addressed in the following products: Red Hat Fuse 7.9 Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140 Marking Red Hat Integration Service Registry as having a low impact, this is because although the vulnerable version of resteasy-client is shipped and used, its use in Service Registry is not susceptible to the vulnerability, this is because its use in the maven plugin it does not communicate with further upstream/backend services from a service context, that is to say the Service Registry service itself does not use the resteasy-client to call onto other services, this is a precondition of the vulnerability. This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7 Via RHSA-2021:2858 https://access.redhat.com/errata/RHSA-2021:2858 |