| Package | Affected versions | Patched versions |
|---|---|---|
| org.jboss.resteasy:resteasy-core | ≥ 4.0.0.Beta1, < 4.7.8.Final≥ 5.0.0.Alpha1, < 5.0.6.Final≥ 6.0.0.Beta1, < 6.2.3.Final< 3.15.5.Final | 4.7.8.Final5.0.6.Final6.2.3.Final3.15.5.Final |
| org.jboss.resteasy:resteasy-multipart-provider | ≥ 4.0.0.Beta1, < 4.7.8.Final≥ 5.0.0.Alpha1, < 5.0.6.Final≥ 6.0.0.Beta1, < 6.2.3.Final< 3.15.5.Final | 4.7.8.Final5.0.6.Final6.2.3.Final3.15.5.Final |
| resteasy | = 3.15.4= 4.7.7= 5.0.5= 6.2.2 |
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
Fixed in the following pull requests:
There is no workaround for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free