Bug 1942819 (CVE-2021-20293)

Summary:	CVE-2021-20293 RESTEasy: PathParam in RESTEasy can lead to a reflected XSS attack
Product:	[Other] Security Response	Reporter:	Ted Jongseok Won <jwon>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, aileenc, alee, alexander.m.scheel, asoldano, atangrin, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bibryam, bkearney, bmaxwell, brian.stansberry, btotty, cdewolf, cfu, chazlett, clement.escoffier, cmoulliard, dandread, darran.lofthouse, dchen, dkreling, dosoudil, drieden, edewata, eleandro, eric.wittmann, fjuma, ggaughan, gmalinko, gsmet, hamadhan, hbraun, hhudgeon, ikanello, iweiss, janstey, java-sig-commits, jmagne, jnethert, jochrist, jpallich, jperkins, jwon, kaycoth, krathod, kwills, lgao, lthon, lzap, mkdineshprasanth, mmccune, msochure, msvehla, mszynkie, nmoumoul, nwallace, pantinor, pcreech, pdrozd, peholase, pgallagh, pjindal, pmackay, probinso, puntogil, rchan, rguimara, rhcs-maint, rjerrido, rruss, rstancel, rsvoboda, sbiarozk, sdouglas, smaestri, sokeeffe, sthorger, tom.jenkinson, weli, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-06 14:54:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1943648, 1945667, 1945668, 1945669
Bug Blocks:	1941409

Description Ted Jongseok Won 2021-03-25 04:50:24 UTC

A cross-site scripting (XSS) flaw was found in RESTEasy, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. An attacker could use this flaw to launch a reflected XSS attack.

Comment 1 Ted Jongseok Won 2021-03-25 04:50:32 UTC

Acknowledgments:

Name: Jeremy Bonghwan Choi (Red Hat), Ted Jongseok Won (Red Hat)

Comment 24 errata-xmlrpc 2021-11-02 12:42:47 UTC

This issue has been addressed in the following products:

  RHINT Service Registry 2.0.2 GA

Via RHSA-2021:4100 https://access.redhat.com/errata/RHSA-2021:4100

Comment 25 errata-xmlrpc 2022-03-23 08:22:37 UTC

This issue has been addressed in the following products:

  RHINT Camel-K 1.6.4

Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029