GHSA-244r-fcj3-ghjq
Exposure of class information in RESTEasy
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jboss.resteasy:resteasy-core | >= 4.6.0, < 4.6.1 | 4.6.1 |
| Maven | org.jboss.resteasy:resteasy-core | >= 4.0.0, < 4.5.10 | 4.5.10 |
| Maven | org.jboss.resteasy:resteasy-core | >= 3.0.0, < 3.16.0 | 3.16.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in RESTEasy in all current versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2021-20289
- https://bugzilla.redhat.com/show_bug.cgi?id=1935927
- https://bugzilla.redhat.com/show_bug.cgi?id=1941544
- https://issues.redhat.com/browse/RESTEASY-2843
- https://security.netapp.com/advisory/ntap-20210528-0008
- https://www.oracle.com/security-alerts/cpuapr2022.html