Description
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | resteasy-base +10 | 2.3.5-3.el7_0 | RHSA-2014:1011 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | resteasy | 2.3.8-5.SP1_redhat_1.1.ep6.el5 | RHSA-2014:1040 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | resteasy-base +10 | 2.3.5-3.el7_0 | ELSA-2014-1011 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jboss.resteasy:resteasy-client | >= 2.3.1, < 2.3.8.SP2 | 2.3.8.SP2 | GHSA-qjpq-5pq3-43rr |
| Maven | org.jboss.resteasy:resteasy-client | >= 3.0.0, < 3.0.9.Final | 3.0.9.Final | GHSA-qjpq-5pq3-43rr |
Advisories 4
- RHSA-2014:1040 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:1011 Red Hat Security Advisory: resteasy-base security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- ELSA-2014-1011 Moderate: resteasy-base security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 5, 2014
References
- https://github.com/ronsigal/Resteasy/commit/9b7d0f574cafdcf3bea5428f3145ab4908fc6d83
- RHSA-2015:0765 vendor-advisory
- RHSA-2015:0675 vendor-advisory
- 60019 third-party-advisory
- RHSA-2015:0720 vendor-advisory
- https://github.com/resteasy/Resteasy/pull/521
- https://github.com/resteasy/Resteasy/pull/533
- RHSA-2014:1039 vendor-advisory
- 69058 vdb-entry
- RHSA-2015:0125 vendor-advisory
- RHSA-2014:1040 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- RHSA-2014:1011 vendor-advisory
- RHSA-2014:1298 vendor-advisory