Description
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm +13 | 3.0.3_0001-3.el6 | RHSA-2012:0421 |
| Red Hat JBoss Web Platform 5 | resteasy +3 | 1.2.1-10.CP02_patch01.1.ep5.el5 | RHSA-2012:1058 |
| Red Hat JBoss EAP 5 | resteasy +3 | 1.2.1-10.CP02_patch01.1.ep5.el4 | RHSA-2012:1059 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 2 | otopi +6 | 1.1.0-1.el6ev | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | python-daemon | 1.5.2-1.el6 | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | python-kitchen | 1.1.1-2.el6ev | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | python-lockfile | 0.8-5.el6 | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | python-ply | 3.3-7.el6ev | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | redhat-access-plugin-storage | 2.1.0-0.el6rhs | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | rhsc +6 | 2.1.0-0.bb10.el6rhs | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | rhsc-cli +1 | 2.1.0.0-0.bb3a.el6rhs | RHSA-2013:1263 |
| Red Hat Gluster Storage 2 | rhsc-log-collector | 2.1-0.1.el6rhs | RHSA-2013:1263 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.resteasy:resteasy-client | < 2.3.1 | 2.3.1 | GHSA-wrrh-g7h3-gqmx |
Advisories 4
- RHSA-2012:1058 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1263 Red Hat Security Advisory: Red Hat Storage Console 2.1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:1059 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0421 Red Hat Security Advisory: rhevm security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=785631
- RHSA-2012:1059 vendor-advisory
- 51748 vdb-entry
- https://issues.jboss.org/browse/RESTEASY-637
- RHSA-2012:1056 vendor-advisory
- RHSA-2012:1058 vendor-advisory
- 51766 vdb-entry
- 78679 vdb-entry
- RHSA-2012:0519 vendor-advisory
- 50084 third-party-advisory
- RHSA-2014:0371 vendor-advisory
- RHSA-2012:1057 vendor-advisory
- resteasy-xml-info-disclosure(72808) vdb-entry
- 48954 third-party-advisory
- RHSA-2012:0441 vendor-advisory
- 47832 third-party-advisory
- 57719 third-party-advisory
- 57716 third-party-advisory
- 47818 third-party-advisory
- RHSA-2014:0372 vendor-advisory
- 48697 third-party-advisory
- RHSA-2012:1125 vendor-advisory