Description
The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm +13 | 3.0.3_0001-3.el6 | RHSA-2012:0421 |
| Red Hat JBoss Web Platform 5 | resteasy +3 | 1.2.1-10.CP02_patch01.1.ep5.el5 | RHSA-2012:1058 |
| Red Hat JBoss EAP 5 | resteasy +3 | 1.2.1-10.CP02_patch01.1.ep5.el4 | RHSA-2012:1059 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.resteasy:resteasy-jaxb-provider | < 2.3.2 | 2.3.2 | GHSA-g4jg-gpwv-p7wv |
Advisories 3
- RHSA-2012:1058 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:1059 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0421 Red Hat Security Advisory: rhevm security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=785631
- 78680 vdb-entry
- RHSA-2012:1059 vendor-advisory
- https://issues.jboss.org/browse/RESTEASY-647
- RHSA-2012:1056 vendor-advisory
- RHSA-2012:1058 vendor-advisory
- 51766 vdb-entry
- RHSA-2012:0519 vendor-advisory
- 50084 third-party-advisory
- RHSA-2014:0371 vendor-advisory
- RHSA-2012:1057 vendor-advisory
- resteasy-xml-info-disclosure(72808) vdb-entry
- RHSA-2012:0441 vendor-advisory
- 47832 third-party-advisory
- 57719 third-party-advisory
- 57716 third-party-advisory
- RHSA-2014:0372 vendor-advisory
- https://issues.jboss.org/browse/RESTEASY/fixforversion/12318708
- RHSA-2012:1125 vendor-advisory