Debian Resteasy vulnerabilities

CVE-2016-7050 [CRITICAL] CVE-2016-7050: resteasy - SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat ... SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code. Scope: local sid: resolved (fixed in 3.0.18-1)

CVE-2016-9606 [HIGH] CVE-2016-9606: resteasy - JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with ... JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions. Scope: local sid: resolved (fixed in 3.1.4-1)

CVE-2020-1695 [HIGH] CVE-2020-1695: resteasy - A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all re... A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed. Scope: local si

CVE-2016-6346 [HIGH] CVE-2016-6346: resteasy - RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denia... RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. Scope: local sid: resolved (fixed in 3.1.0-1)

CVE-2014-7839 [MEDIUM] CVE-2014-7839: resteasy - DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external... DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors. Scope: local sid: resolved (fixed in 3.0.6-2)

CVE-2017-7561 [HIGH] CVE-2017-7561: resteasy - Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a se... Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact. Scope: local sid: resolved (fixed in 3.6.2-1)

CVE-2016-6345 [MEDIUM] CVE-2016-6345: resteasy - RESTEasy allows remote authenticated users to obtain sensitive information by le... RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. Scope: local sid: resolved (fixed in 3.1.0-1)

CVE-2020-10688 [MEDIUM] CVE-2020-10688: resteasy - A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.... A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack. Scope: local sid: open

CVE-2016-6347 [MEDIUM] CVE-2016-6347: resteasy - Cross-site scripting (XSS) vulnerability in the default exception handler in RES... Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local sid: resolved (fixed in 3.1.0-1)

CVE-2016-6348 [MEDIUM] CVE-2016-6348: resteasy - JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cr... JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack. Scope: local sid: resolved (fixed in 3.1.0-1)