PT-2012-2222 · Red Hat · Resteasy

David Jorm · Publicado 2012-11-23 · Atualizado 2022-05-17 · CVE-2011-5245

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RESTEasy versions prior to 2.3.2

Description The issue allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input. This is an XML external entity (XXE) injection attack.

Recommendations For versions prior to 2.3.2, update to version 2.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the readFrom function in providers.jaxb.JAXBXmlTypeProvider to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-5245

GHSA-G4JG-GPWV-P7WV

RHSA-2012:0421

RHSA-2012:1058

RHSA-2012:1059

Produtos afetados

Resteasy

Referências · 23

• https://github.com/resteasy/Resteasy · Nota
• https://github.com/resteasy/resteasy/pull/34 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5245 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2012-0441.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-0519.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1056.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1059.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-g4jg-gpwv-p7wv · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-1058.html · Aviso do Fabricante
• https://issues.jboss.org/browse/RESTEASY/fixforversion/12318708 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1125.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=785631 · Nota
• https://issues.jboss.org/browse/RESTEASY-647 · Correção
• http://secunia.com/advisories/47832 · Aviso do Fabricante
• http://secunia.com/advisories/57719 · Nota