Skip to content
OpenAdvisories
Medium ELSA-2014-1011 1 CVE

Moderate: resteasy-base security update (Oracle Linux 7)

Published Aug 5, 2014 · Updated Aug 5, 2014

Ecosystem: Oracle Linux

Summary

[2.3.5-3]
- Resolves: rhbz1121917 - CVE-2014-3490: XXE via parameter entities

Fixed packages 11

ReleasePackageFixed in
Oracle Linux · 7 resteasy-base 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-atom-provider 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-jackson-provider 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-javadoc 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-jaxb-provider 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-jaxrs 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-jaxrs-all 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-jaxrs-api 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-jettison-provider 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-providers-pom 0:2.3.5-3.el7_0
Oracle Linux · 7 resteasy-base-tjws 0:2.3.5-3.el7_0

Vulnerabilities 1

  • High —
    CVE-2014-3490

    Incorrect Privilege Assignment in RESTEasy

    RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote a…

    org.jboss.resteasy:resteasy-client Maven