CVE-2020-1695: Improper Input Validation in RESTEasy
Summary
CVE-2020-1695: Improper Input Validation in RESTEasy. Affects org.jboss.resteasy:resteasy-client across 2 version ranges.
>= 3.0.0, < 3.12.0
>= 4.0.0, < 4.6.0
Fixed in 3.12.0 or 4.6.0, depending on the release line you run. How to fix ↓
Also tracked for
- resteasy3.0 · Debian:11
The same CVE-2020-1695 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RESTEasy package is a set of frameworks and tools for building RESTful web services in Java. It provides a simplified approach to developing RESTful APIs and includes features such as client and server implementations, support for various HTTP methods, and input/output handling. However, versions prior to 3.12.0.Final and 4.6.0.Final are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in RESTEasy arises from improper input validation, which results in the server returning an illegal header that integrates into the response. This flaw can be exploited to inject malicious code, leading to unexpected behavior when constructing the HTTP response. The injection can have severe consequences, potentially compromising the integrity and security of the server and its data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.12.03.12.0 -
>= 4.0.0, < 4.6.04.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update the RESTEasy package to the fixed versions mentioned above.
Conclusion
The improper input validation vulnerability in RESTEasy can have serious consequences, potentially compromising the security and integrity of the server. It is crucial to update to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.resteasy:resteasy-client →
FAQ
RESTEasy is a Java framework for building RESTful web services.
All versions prior to 3.12.0.Final and 4.6.0.Final are affected.
The vulnerability allows for injection of illegal headers, leading to unexpected behavior and potential security compromises.
Update the RESTEasy package to version 3.12.0.Final or 4.6.0.Final.
No, updating to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-client.
