CVE-2020-14326: Vulnerability in RESTEasy 4.5.5.Final
Summary
CVE-2020-14326: RESTEasy 4.5.5.Final in hash flooding. Affects org.jboss.resteasy:resteasy-bom versions < 4.5.6.Final. Fixed in 4.5.6.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RESTEasy is a Java-based framework that simplifies the development of RESTful web services. It provides a set of annotations and utilities to build and consume RESTful APIs. The RESTEasy package, specifically version 4.5.5.Final, is affected by a vulnerability that allows for hash flooding. This flaw occurs due to incorrect caching of routes by the RootNode, resulting in slower requests and increased CPU usage. An attacker can exploit this vulnerability to cause a denial of service.
Vulnerability Detail
The vulnerability in RESTEasy 4.5.5.Final stems from the incorrect caching of routes by the RootNode. This leads to hash flooding, which in turn causes slower requests and higher CPU usage. By exploiting this flaw, an attacker can launch a denial of service attack, impacting the availability and performance of the affected application. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
4.5.6.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to upgrade to the fixed version of the RESTEasy package to ensure the security and stability of the application.
Conclusion
In conclusion, the RESTEasy 4.5.5.Final package is vulnerable to hash flooding, which can be exploited by an attacker to launch a denial of service attack. To mitigate this vulnerability, it is recommended to upgrade to version 4.5.6.Final or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.resteasy:resteasy-bom →
FAQ
RESTEasy is a Java-based framework that simplifies the development of RESTful web services. It provides annotations and utilities to build and consume RESTful APIs.
The vulnerability allows for hash flooding, resulting in slower requests and increased CPU usage. This can lead to a denial of service, impacting the availability and performance of the affected application.
To fix this vulnerability, upgrade the RESTEasy package to version 4.5.6.Final or later. This version includes the necessary fixes to address the hash flooding issue.
No, there is no specific workaround available for this vulnerability. It is crucial to upgrade to the fixed version of the RESTEasy package.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-bom.
