high7.5
CVE-2020-1695
Improper Input Validation in RESTEasy
Impact
A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jboss.resteasy:resteasy-client | >= 4.0.0, <= 4.5.12 | 4.6.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Resteasy | from 3.0.0 before 3.12.0 from 4.0.0 before 4.6.0 |
| Fedoraproject | Fedora | Versions 32, 33 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1695
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJDMT443YZWCBS5NS76XZ7TL3GK7BXHL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RX22C6I56BJUER76IIPYHGZIWBQIU3CQ/
- https://github.com/advisories/GHSA-63cq-ppq8-cw6g
- https://nvd.nist.gov/vuln/detail/CVE-2020-1695
- https://github.com/resteasy/Resteasy/commit/88ba8537f2e8d465c7031d352bf9bb25526ce475
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJDMT443YZWCBS5NS76XZ7TL3GK7BXHL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RX22C6I56BJUER76IIPYHGZIWBQIU3CQ/