A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information in headers, cookies and body when the server got WebApplicationException from the RESTEasy client call.
Affected artifacts: https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-client/ https://maven.repository.redhat.com/ga/org/jboss/resteasy/resteasy-client-microprofile/
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2021:0250 https://access.redhat.com/errata/RHSA-2021:0250
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Via RHSA-2021:0246 https://access.redhat.com/errata/RHSA-2021:0246
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Via RHSA-2021:0247 https://access.redhat.com/errata/RHSA-2021:0247
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2021:0248 https://access.redhat.com/errata/RHSA-2021:0248
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25633
This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2021:0295 https://access.redhat.com/errata/RHSA-2021:0295
This issue has been addressed in the following products: Red Hat build of Quarkus Via RHSA-2021:1004 https://access.redhat.com/errata/RHSA-2021:1004
This issue has been addressed in the following products: Red Hat Satellite 6.8 for RHEL 7 Via RHSA-2021:1313 https://access.redhat.com/errata/RHSA-2021:1313
This issue has been addressed in the following products: Red Hat Fuse 7.9 Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140
Marking Red Hat Integration Service Registry as having a low impact, this is because although the vulnerable version of resteasy-client is shipped and used, its use in Service Registry is not susceptible to the vulnerability, this is because its use in the maven plugin it does not communicate with further upstream/backend services from a service context, that is to say the Service Registry service itself does not use the resteasy-client to call onto other services, this is a precondition of the vulnerability.