Solution
Please Install the Updated Packages.
Insight
RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.
It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the
resteasy.document.expand.entity.references parameter was set to false.
A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
(CVE-2014-3490)
This issue was discovered by David Jorm of Red Hat Product Security.
All resteasy-base users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Affected
resteasy-base on Red Hat Enterprise Linux Server (v. 7)
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2012-0818, CVE-2014-3490 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities