Skip to content
OpenAdvisories
Unscored RHSA-2012:1059 2 CVEs

Red Hat Security Advisory: resteasy security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 resteasy 0:1.2.1-10.CP02_patch01.1.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 resteasy-examples 0:1.2.1-10.CP02_patch01.1.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 resteasy-javadoc 0:1.2.1-10.CP02_patch01.1.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 resteasy-manual 0:1.2.1-10.CP02_patch01.1.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 resteasy 0:1.2.1-10.CP02_patch01.1.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 resteasy-examples 0:1.2.1-10.CP02_patch01.1.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 resteasy-javadoc 0:1.2.1-10.CP02_patch01.1.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 resteasy-manual 0:1.2.1-10.CP02_patch01.1.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 resteasy 0:1.2.1-10.CP02_patch01.1.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 resteasy-examples 0:1.2.1-10.CP02_patch01.1.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 resteasy-javadoc 0:1.2.1-10.CP02_patch01.1.ep5.el6
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 resteasy-manual 0:1.2.1-10.CP02_patch01.1.ep5.el6

Vulnerabilities 2

  • Medium —
    CVE-2011-5245

    Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

    The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injecti…

    org.jboss.resteasy:resteasy-jaxb-provider Maven
  • Medium —
    CVE-2012-0818

    Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

    RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.

    org.jboss.resteasy:resteasy-client Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=785631
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1059.json
  • report
    https://access.redhat.com/security/cve/CVE-2011-5245
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2011-5245
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2011-5245
  • report
    https://access.redhat.com/security/cve/CVE-2012-0818
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-0818
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-0818