Bug 13306

Summary: [CVE 21] resteasy 3.0.19 CVEs found
Product: [ROSA-based products] ROSA Fresh Reporter: Yury <y.tumanov>
Component: System (kernel, glibc, systemd, bash, PAM...)Assignee: ROSA Linux Bugs <bugs>
Status: CONFIRMED --- QA Contact: ROSA Linux Bugs <bugs>
Severity: critical    
Priority: Highest CC: m.novosyolov, s.matveev, v.potapov, y.tumanov
Version: AllFlags: y.tumanov: secteam_verified?
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: CVE-2020-10688, CVE-2020-1695, CVE-2020-25633, CVE-2023-0482,CVE-2016-9606,CVE-2021-20289,CVE-2021-20293
Whiteboard:
Platform: 2021.1 ROSA Vulnerability identifier:
RPM Package: ISO-related:
Bad POT generating: Upstream:

Description Yury 2023-05-03 18:02:20 MSK 
Please patch CVEs for package resteasy version 3.0.19
  
INFO (CVEs are): resteasy 3.0.19
 cves found
CVE-2020-10688
Desc: A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-10688
Severity: MEDIUM
CVE-2020-1695
Desc: A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-1695
Severity: HIGH
CVE-2020-25633
Desc: A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.
Link: https://nvd.nist.gov/vuln/detail/CVE-2020-25633
Severity: MEDIUM
CVE-2023-0482
Desc: In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0482
Severity: MEDIUM
Comment 1 Mikhail Novosyolov 2023-05-15 15:24:18 MSK 
В этом пакете пока не будем исправлять CVE в связи с отсутствием его широкого применения и сложностью их закрытия.
Comment 2 Vladimir Potapov 2024-01-12 10:08:36 MSK 
*** Bug 13800 has been marked as a duplicate of this bug. ***