Skip to content
OpenAdvisories
High · 8.1 CVE-2016-9606 EUVD-2022-4144GHSA-hgjr-xwj3-jfvw

JBoss RESTEasy vulnerable to Improper Input Validation

Published Mar 9, 2018 · Updated Sep 16, 2024 · Assigned by redhat

Vendor: Red Hat Product: RESTEasy Package: org.jboss.resteasy:resteasy-bom Package: resteasy Package: resteasy3.0 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.

Affected products

VendorProductAffectedFixed
Red Hat RESTEasy 3.1.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 resteasy3.0 3.0.26-1 —
Debian 13 resteasy3.0 3.0.26-1 —
Debian 12 resteasy3.0 3.0.26-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS resteasy No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +14 1.1.0-17.SP20_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.1.10-2.redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-commons-logging-jboss-logmanager 1.0.0-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-glassfish-javamail 1.5.5-2.redhat_2.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-hibernate +5 5.0.13-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-hibernate-validator +1 5.2.5-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-infinispan +5 8.1.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.3.6-2.Final_redhat_2.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-ec2-eap +1 7.0.6-1.GA_redhat_1.ep7.el6 RHSA-2017:1412
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 2.1.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-el-api_3.0_spec 1.0.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-logging 3.3.1-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-metadata +5 10.0.1-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-modules 1.5.3-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-remoting 4.0.22-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-security-negotiation 3.0.4-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.4.4-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jbossws-common 3.1.5-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jbossws-common-tools 1.2.3-2.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jbossws-cxf 5.1.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-jbossws-spi 3.1.4-2.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-picketbox +1 4.9.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-8.SP7_redhat_2.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-resteasy +17 3.0.19-5.SP3_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-undertow 1.3.28-4.Final_redhat_4.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-wildfly +1 7.0.6-4.GA_redhat_2.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.0.4-1.Final_redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-wildfly-javadocs 7.0.6-2.GA_redhat_3.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 7 eap7-wss4j +6 2.1.8-2.redhat_1.1.ep7.el6 RHSA-2017:1411, RHSA-2017:1410
Red Hat JBoss EAP 6 hibernate4-eap6 +4 4.2.26-1.Final_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 hornetq 2.3.25-20.SP18_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 httpserver 1.0.8-1.Final_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 ironjacamar-eap6 +9 1.0.38-3.Final_redhat_3.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 jboss-as-ee +61 7.5.15-1.Final_redhat_3.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 jboss-ec2-eap +1 7.5.15-3.Final_redhat_3.ep6.el6 RHSA-2017:1260
Red Hat JBoss EAP 6 jboss-ejb-client 1.0.39-1.Final_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 jboss-security-negotiation 2.3.13-1.Final_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 jboss-xnio-base 3.0.16-1.GA_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 jbossas-javadocs 7.5.15-3.Final_redhat_3.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 jbossweb 7.5.22-1.Final_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 picketbox 4.1.5-1.Final_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 picketlink-bindings +1 2.5.4-14.SP12_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253
Red Hat JBoss EAP 6 resteasy 2.3.19-1.Final_redhat_1.1.ep6.el5 RHSA-2017:1256, RHSA-2017:1254, RHSA-2017:1253

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jboss.resteasy:resteasy-bom < 3.1.2.Final 3.1.2.Final GHSA-hgjr-xwj3-jfvw

Advisories 7

References