PT-2012-2222 · Red Hat · Resteasy

David Jorm · Published 2012-11-23 · Updated 2022-05-17 · CVE-2011-5245

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RESTEasy versions prior to 2.3.2

Description The issue allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input. This is an XML external entity (XXE) injection attack.

Recommendations For versions prior to 2.3.2, update to version 2.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the readFrom function in providers.jaxb.JAXBXmlTypeProvider to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-5245

GHSA-G4JG-GPWV-P7WV

RHSA-2012:0421

RHSA-2012:1058

RHSA-2012:1059

Affected Products

Resteasy

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2011-5245 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-0441.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0519.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1056.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1059.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4jg-gpwv-p7wv · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1058.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1125.html · Vendor Advisory
• https://issues.jboss.org/browse/RESTEASY-647 · Patch
• http://secunia.com/advisories/47832 · Vendor Advisory
• http://secunia.com/advisories/50084 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0371.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0372.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1057.html · Vendor Advisory
• https://github.com/resteasy/Resteasy · Note