Skip to content
OpenAdvisories
Medium · 5.4 CVE-2020-10688 EUVD-2021-1240GHSA-29qj-rvv6-qrmv

Cross-site scripting in RESTEasy

Published May 27, 2021 · Updated Aug 4, 2024 · Assigned by redhat

Package: org.jboss.resteasy:resteasy-bom Package: org.jboss.resteasy:resteasy-core Package: resteasy Package: resteasy3.0 Package: resteasy3.0 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

Affected products

VendorProductAffectedFixed
— RESTEasy resteasy 3.11.1.Final, resteasy 4.5.3.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 resteasy3.0 3.0.26-4 —
Debian 13 resteasy3.0 3.0.26-4 —
Debian 12 resteasy3.0 3.0.26-4 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 resteasy No fix yet —
Ubuntu 26.04 LTS resteasy No fix yet —
Ubuntu 25.10 resteasy No fix yet —
Ubuntu 24.04 LTS resteasy3.0 3.0.26-6ubuntu0.24.04.1 USN-7630-1
Ubuntu 22.04 LTS resteasy3.0 3.0.26-3ubuntu0.1 USN-7630-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS resteasy 3.6.2-2ubuntu0.24.04.1~esm1 USN-7351-1
Ubuntu Pro 22.04 LTS resteasy 3.6.2-2ubuntu0.22.04.1~esm1 USN-7351-1
Ubuntu Pro 20.04 LTS resteasy 3.6.2-2ubuntu0.20.04.1~esm1 USN-7351-1
Ubuntu Pro 20.04 LTS resteasy3.0 3.0.26-1ubuntu0.1~esm1 USN-7630-1
Ubuntu Pro 18.04 LTS resteasy3.0 3.0.26-1~18.04.1~esm1 USN-7630-1
Ubuntu Pro 16.04 LTS resteasy 3.0.6-3ubuntu0.1~esm1 USN-7630-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-4.redhat_00010.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.3.5-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-bouncycastle +3 1.60.0-2.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-codehaus-jackson +4 1.9.13-10.redhat_00007.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-cryptacular 1.2.4-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-elytron-web +1 1.6.1-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.9-10.SP09_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-hal-console 3.2.8-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.16-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-infinispan +8 9.4.18-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.20-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jackson-core +10 2.10.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jaegertracing-jaeger-client-java +2 0.34.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jakarta-el 3.0.3-1.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jandex 2.1.2-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.31-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.3_spec 3.0.0-3.SP02_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-modules 1.10.0-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.18-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-remoting-jmx 3.0.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.1-5.Final_redhat_00006.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-vfs 3.2.15-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-weld-3.1-api +2 3.1.0-6.SP2_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-config +1 1.4.0-1.redhat_00003.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-health 2.2.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-metrics +1 2.3.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-opentracing +1 1.3.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-rest-client +1 1.4.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-opensaml +13 3.3.1-1.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.3-7.Final_redhat_00006.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-picketlink-bindings +1 2.5.5-23.SP12_redhat_00012.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-resteasy +19 3.11.2-3.Final_redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-slf4j-jboss-logmanager 1.0.4-1.GA_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-config 1.6.2-3.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-health 2.2.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-metrics 2.4.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-opentracing 1.3.4-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-snakeyaml 1.24.0-2.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-stax2-api 4.2.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-sun-istack-commons +2 3.0.10-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-txw2 +8 2.3.3-4.b02_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-undertow 2.0.30-3.SP3_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.1.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.1-5.GA_redhat_00003.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.6-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.20-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.1-5.GA_redhat_00003.1.el7eap RHSA-2020:2512
Red Hat JBoss EAP 7 eap7-wildfly-naming-client 1.0.12-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.11-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-woodstox-core 6.0.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wss4j +6 2.2.5-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jboss.resteasy:resteasy-bom < 3.11.1.Final 3.11.1.Final GHSA-29qj-rvv6-qrmv
Maven org.jboss.resteasy:resteasy-bom >= 4.0.0, < 4.5.3.Final 4.5.3.Final GHSA-29qj-rvv6-qrmv
Maven org.jboss.resteasy:resteasy-core < 3.11.1.Final 3.11.1.Final GHSA-29qj-rvv6-qrmv
Maven org.jboss.resteasy:resteasy-core >= 4.0.0, < 4.5.3.Final 4.5.3.Final GHSA-29qj-rvv6-qrmv

Advisories 6

References