CVE-2020-25633: Generation of Error Message Containing Sensitive Information in RESTEasy client
Summary
CVE-2020-25633: Generation of Error Message Containing Sensitive Information in RESTEasy client. Affects org.jboss.resteasy:resteasy-client across 2 version ranges.
< 3.14.0.Final
>= 4.0.0, < 4.5.7.Final
Fixed in 3.14.0.Final or 4.5.7.Final, depending on the release line you run. How to fix ↓
Also tracked for
- resteasy3.0 · Debian:11
The same CVE-2020-25633 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RESTEasy client is a library used for making RESTful web service calls in Java applications. It provides a convenient way to interact with RESTful APIs. The vulnerability identified as CVE-2020-25633 affects all versions of RESTEasy up to 4.5.6.Final. This vulnerability allows client users to potentially obtain sensitive information from the server when the server encounters a WebApplicationException during a RESTEasy client call. The confidentiality of data is at risk due to this vulnerability.
Vulnerability Detail
The vulnerability arises from the generation of error messages that contain sensitive information. When the server encounters a WebApplicationException, which is an exception thrown by RESTEasy to indicate a failure in processing a request, the error message may inadvertently include sensitive information. This could include details such as server configuration, database credentials, or other sensitive data. An attacker with access to these error messages could exploit this information to gain unauthorized access or perform other malicious activities. The severity of this vulnerability is considered moderate.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.14.0.Final3.14.0.Final -
>= 4.0.0, < 4.5.7.Final4.5.7.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a workaround can be implemented by modifying the error handling mechanism in the application. This can involve customizing the error response to remove any sensitive information before it is returned to the client. The specific implementation of this workaround will depend on the application framework and architecture being used.
Conclusion
The vulnerability identified as CVE-2020-25633 in the RESTEasy client library can potentially expose sensitive information from the server to client users. It is important to upgrade to the fixed version or implement the recommended workaround to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.resteasy:resteasy-client →
FAQ
RESTEasy client is a Java library used for making RESTful web service calls. It provides a convenient way to interact with RESTful APIs.
WebApplicationException is an exception thrown by RESTEasy to indicate a failure in processing a request. It is used to handle errors and exceptions in RESTful web services.
This vulnerability can potentially expose sensitive information from the server to client users. This information could be used by attackers to gain unauthorized access or perform other malicious activities, compromising data confidentiality.
The severity of this vulnerability is considered moderate. While it has the potential to expose sensitive information, it requires specific conditions to be met for exploitation.
The recommended mitigation is to upgrade to RESTEasy version 4.5.7.Final or later. This version includes a fix for the vulnerability. Alternatively, a workaround can be implemented by customizing the error handling mechanism to remove sensitive information from error messages.
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-client.
