CVE-2017-7561: Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP
Summary
CVE-2017-7561: Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP. Affects org.jboss.resteasy:resteasy-jaxrs across 2 version ranges.
>= 3.0.7.Final, < 3.0.25.Final
>= 3.1.4.Final, < 3.5.0.CR1
Fixed in 3.0.25.Final or 3.5.0.CR1, depending on the release line you run. How to fix ↓
Also tracked for
- resteasy3.0 · Debian:11
The same CVE-2017-7561 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Red Hat JBoss EAP is an open-source Java-based application server that provides a platform for building and deploying enterprise Java applications. It includes the JAX-RS component, which is responsible for handling RESTful web services. This vulnerability affects versions 3.0.7.Final until 3.0.25.Final, 3.5.0.CR1, and 4.0.0.Beta1 of Red Hat JBoss EAP. The vulnerability involves an inconsistent interpretation of HTTP requests, which can lead to server-side cache poisoning or Cross-Origin Resource Sharing (CORS) requests. This vulnerability has a moderate impact and can potentially be exploited to perform unauthorized actions or access sensitive information.
Vulnerability Detail
The vulnerability in Red Hat JBoss EAP arises from the inconsistent interpretation of HTTP requests in the JAX-RS component. This can be exploited by an attacker to manipulate server-side caches or bypass CORS restrictions. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of unauthorized actions. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.7.Final, < 3.0.25.Final3.0.25.Final -
>= 3.1.4.Final, < 3.5.0.CR13.5.0.CR1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of Red Hat JBoss EAP as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Red Hat JBoss EAP, identified as CVE-2017-7561, involves an inconsistent interpretation of HTTP requests in the JAX-RS component. This vulnerability can be exploited to perform server-side cache poisoning or bypass CORS restrictions, potentially leading to unauthorized access or actions. It is crucial to upgrade to a fixed version of Red Hat JBoss EAP to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.resteasy:resteasy-jaxrs →
FAQ
Red Hat JBoss EAP is an open-source Java-based application server that provides a platform for building and deploying enterprise Java applications.
The JAX-RS component is responsible for handling RESTful web services in Red Hat JBoss EAP.
Server-side cache poisoning refers to the manipulation of server-side caches to store and serve malicious or unauthorized content.
Cross-Origin Resource Sharing (CORS) requests are HTTP requests that are made from a different origin than the server, and they require proper authorization to be processed.
This vulnerability can lead to unauthorized access to sensitive information or the execution of unauthorized actions.
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-jaxrs.
