Skip to content
OpenAdvisories
High · 7.5 CVE-2017-7561 EUVD-2022-2523GHSA-57q5-x8jf-g7h8

Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP

Published Sep 13, 2017 · Updated Sep 16, 2024 · Assigned by redhat

Vendor: Red Hat Product: RESTEasy Package: org.jboss.resteasy:resteasy-jaxrs Package: resteasy3.0 Package: resteasy3.0 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.

Affected products

VendorProductAffectedFixed
Red Hat resteasy 3.0.7 through before 4.0.0Beta1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 resteasy3.0 3.0.26-1 —
Debian 13 resteasy3.0 3.0.26-1 —
Debian 12 resteasy3.0 3.0.26-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS resteasy3.0 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +14 1.1.0-19.SP24_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479, RHSA-2018:0004
Red Hat JBoss EAP 7 eap7-activemq-artemis-jdbc-store 1.5.5.009-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.1.13-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.2.13-6.SP5_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-hibernate +5 5.0.16-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479, RHSA-2018:0004
Red Hat JBoss EAP 7 eap7-infinispan +5 8.2.9-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.3.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479, RHSA-2018:0004
Red Hat JBoss EAP 7 eap7-jackson-core +9 2.8.11-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jboss-ec2-eap +1 7.0.9-2.GA_redhat_2.ep7.el6 RHSA-2018:0481, RHSA-2018:0005
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.0.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jboss-remoting 4.0.25-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0004, RHSA-2018:0002
Red Hat JBoss EAP 7 eap7-jboss-server-migration +18 1.0.3-6.Final_redhat_6.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.4.7-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0004, RHSA-2018:0002
Red Hat JBoss EAP 7 eap7-jbossws-cxf 5.1.10-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jgroups 3.6.12-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0004, RHSA-2018:0002
Red Hat JBoss EAP 7 eap7-narayana +10 5.5.31-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-10.SP9_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-resteasy +17 3.0.19-7.SP5_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479, RHSA-2018:0004
Red Hat JBoss EAP 7 eap7-undertow 1.3.31-3.Final_redhat_3.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479, RHSA-2018:0004
Red Hat JBoss EAP 7 eap7-undertow-jastow 2.0.3-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly +1 7.0.9-4.GA_redhat_3.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479, RHSA-2018:0004
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.1.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.9-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-javadocs 7.0.9-2.GA_redhat_3.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479, RHSA-2018:0004
Red Hat JBoss EAP 7 eap7-wss4j +6 2.1.11-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-xml-security 2.0.9-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jboss.resteasy:resteasy-jaxrs >= 3.0.7.Final, < 3.0.25.Final 3.0.25.Final GHSA-57q5-x8jf-g7h8
Maven org.jboss.resteasy:resteasy-jaxrs >= 3.1.4.Final, < 3.5.0.CR1 3.5.0.CR1 GHSA-57q5-x8jf-g7h8

Advisories 7

References