PT-2019-6418 · Red Hat+6 · Resteasy+7

Mirko Selber + 1 · Published 2019-07-16 · Updated 2025-10-14 · CVE-2020-1695

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions resteasy versions 3.x.x prior to 3.12.0.Final resteasy versions 4.x.x prior to 4.6.0.Final

Description A flaw was found in resteasy where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed. The issue is related to insufficient input validation, which can be exploited by a remote attacker to modify information.

Recommendations For resteasy versions 3.x.x prior to 3.12.0.Final, update to version 3.12.0.Final or later. For resteasy versions 4.x.x prior to 4.6.0.Final, update to version 4.6.0.Final or later. As a temporary workaround, consider implementing proper input validation to prevent illegal headers from being integrated into the server's response.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2022-7681

BDU:2024-01095

CESA-2021_1775

CVE-2020-1695

GHSA-63CQ-PPQ8-CW6G

MGASA-2021-0039

OESA-2022-1483

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

RHSA-2020:3637

RHSA-2020:3638

RHSA-2020:3639

RHSA-2021:1775

RHSA-2021_1775

RLSA-2021:1775

USN-7351-1

USN-7630-1

Affected Products

Alt Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

Resteasy

References · 65

• https://nvd.nist.gov/vuln/detail/CVE-2020-1695 · Security Note
• https://osv.dev/vulnerability/USN-7351-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7351-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-1775.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6345 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1695 · Security Note
• https://osv.dev/vulnerability/GHSA-63cq-ppq8-cw6g · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RX22C6I56BJUER76IIPYHGZIWBQIU3CQ · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7050 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1695 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:1775 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7630-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0039.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-1695 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory