CVE-2023-0482
published 2023-02-17CVE-2023-0482: In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.82%
53.1th percentile
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | resteasy | — | — |
| debian | resteasy3.0 | — | — |
| redhat | resteasy | — | — |
| redhat | resteasy | — | — |
| redhat | resteasy | — | — |
| redhat | resteasy | — | — |
| redhat | resteasy | — | — |
| redhat | resteasy | >= 0 < 3.0.6-3ubuntu0.1~esm1 | 3.0.6-3ubuntu0.1~esm1 |
| redhat | resteasy | >= 0 < 3.6.2-2ubuntu0.20.04.1~esm1 | 3.6.2-2ubuntu0.20.04.1~esm1 |
| redhat | resteasy | >= 0 < 3.6.2-2ubuntu0.22.04.1~esm1 | 3.6.2-2ubuntu0.22.04.1~esm1 |
| redhat | resteasy | >= 0 < 3.6.2-2ubuntu0.24.04.1~esm1 | 3.6.2-2ubuntu0.24.04.1~esm1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ghsa5.5MEDIUM
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
resteasy, resteasy3.0 vulnerabilities
osv·2025-07-10·CVSS 6.5
CVE-2016-6345 [MEDIUM] resteasy, resteasy3.0 vulnerabilities
resteasy, resteasy3.0 vulnerabilities
It was discovered that RESTEasy made insufficient use of random values in
asynchronous jobs. An attacker could possibly use this issue to steal
user data. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6345)
It was discovered that RESTEasy enabled a vulnerable GZIP decompression
module by default. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-6346)
It was discovered that RESTEasy improperly made use of unsanitized data
while handling certain errors. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.
This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6347)
It was discovered that RESTEasy enabled a vulnerable JSON mani
OSV
resteasy vulnerabilities
osv·2025-03-13·CVSS 6.1
CVE-2020-10688 [MEDIUM] resteasy vulnerabilities
resteasy vulnerabilities
Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding
when certain errors occur. An attacker could possibly use this issue to
modify the app's behavior for other users through the network.
(CVE-2020-10688)
Mirko Selber discovered that RESTEasy improperly validated user input
during HTTP response construction. This issue could possibly allow an
attacker to cause a denial of service or execute arbitrary code.
(CVE-2020-1695)
It was discovered that RESTEasy unintentionally disclosed potentially
sensitive server information to users during the handling of certain
errors. (CVE-2020-25633)
It was discovered that RESTEasy unintentionally disclosed parts of its code
to users during the handling of certain errors. (CVE-2021-20289)
It was discovere
OSV
Insecure Temporary File in RESTEasy
osv·2025-01-15·CVSS 5.5
CVE-2023-0482 [MEDIUM] Insecure Temporary File in RESTEasy
Insecure Temporary File in RESTEasy
### Impact
In RESTEasy the insecure `File.createTempFile()` is used in the `DataSourceProvider`, `FileProvider` and `Mime4JWorkaround` classes which creates temp files with insecure permissions that could be read by a local user.
### Patches
Fixed in the following pull requests:
* https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1)
* https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final)
* https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final)
* https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final)
* https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final)
### Workarounds
There is no workaround for this issue.
### References
* https://nvd.nist.gov/vuln/detail/CVE-2023-0482
* https://bugzilla.redhat.com/show_bug.cgi?
GHSA
Insecure Temporary File in RESTEasy
ghsa·2025-01-15·CVSS 5.5
CVE-2023-0482 [MEDIUM] CWE-378 Insecure Temporary File in RESTEasy
Insecure Temporary File in RESTEasy
### Impact
In RESTEasy the insecure `File.createTempFile()` is used in the `DataSourceProvider`, `FileProvider` and `Mime4JWorkaround` classes which creates temp files with insecure permissions that could be read by a local user.
### Patches
Fixed in the following pull requests:
* https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1)
* https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final)
* https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final)
* https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final)
* https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final)
### Workarounds
There is no workaround for this issue.
### References
* https://nvd.nist.gov/vuln/detail/CVE-2023-0482
* https://bugzilla.redhat.com/show_bug.cgi?
OSV
CVE-2023-0482: In RESTEasy the insecure File
osv·2023-02-17·CVSS 5.5
CVE-2023-0482 [MEDIUM] CVE-2023-0482: In RESTEasy the insecure File
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Ubuntu
RESTEasy vulnerabilities
vendor_ubuntu·2025-07-10·CVSS 6.5
CVE-2021-20289 [MEDIUM] RESTEasy vulnerabilities
Title: RESTEasy vulnerabilities
Summary: Several security issues were fixed in resteasy, resteasy3.0.
It was discovered that RESTEasy made insufficient use of random values in
asynchronous jobs. An attacker could possibly use this issue to steal
user data. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-6345)
It was discovered that RESTEasy enabled a vulnerable GZIP decompression
module by default. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2016-6346)
It was discovered that RESTEasy improperly made use of unsanitized data
while handling certain errors. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS. (CVE-2016-6347
Ubuntu
RESTEasy vulnerabilities
vendor_ubuntu·2025-03-13·CVSS 6.1
CVE-2020-1695 [MEDIUM] RESTEasy vulnerabilities
Title: RESTEasy vulnerabilities
Summary: Several security issues were fixed in RESTEasy.
Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding
when certain errors occur. An attacker could possibly use this issue to
modify the app's behavior for other users through the network.
(CVE-2020-10688)
Mirko Selber discovered that RESTEasy improperly validated user input
during HTTP response construction. This issue could possibly allow an
attacker to cause a denial of service or execute arbitrary code.
(CVE-2020-1695)
It was discovered that RESTEasy unintentionally disclosed potentially
sensitive server information to users during the handling of certain
errors. (CVE-2020-25633)
It was discovered that RESTEasy unintentionally disclosed parts of its code
to users during t
Red Hat
RESTEasy: creation of insecure temp files
vendor_redhat·2023-01-31·CVSS 5.5
CVE-2023-0482 [MEDIUM] CWE-378 RESTEasy: creation of insecure temp files
RESTEasy: creation of insecure temp files
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Package: RESTEasy (A-MQ Clients 2) - Fix deferred
Package: org.keycloak-keycloak-parent (Migration Toolkit for Runtimes) - Affected
Package: RESTEasy (Red Hat A-MQ Online) - Fix deferred
Package: RESTEasy (Red Hat build of Apicurio Registry 2) - Affected
Package: org.jboss.resteasy/resteasy-core (Red Hat build of Quarkus) - Not affected
Package: RESTEasy (Red Hat Data Grid 8) - Not affected
Package: resteasy (Red Hat Enterprise Linux 8) - Fix deferred
Package: resteasy (Red Hat Enterprise Linux 9) - Fix deferred
Package: RESTEasy (
Debian
CVE-2023-0482: resteasy - In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider...
vendor_debian·2023·CVSS 5.5
CVE-2023-0482 [MEDIUM] CVE-2023-0482: resteasy - In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider...
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Scope: local
sid: open
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56https://security.netapp.com/advisory/ntap-20230427-0001/https://github.com/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56https://security.netapp.com/advisory/ntap-20230427-0001/
2023-02-17
Published