Generation of Error Message Containing Sensitive Information in RESTEasy client

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-25633 · ADVISORY
• resteasy/Resteasy#2665 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• issues.redhat.com/browse/RESTEASY-2820 · WEB

org.jboss.resteasy:resteasy-client のその他の脆弱性

• CVE-2020-1695高 7.5A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an imprope…
• CVE-2016-6347中 6.1Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script…
• CVE-2016-6348中 6.1JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.
• CVE-2016-6345中 6.5RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.
• CVE-2014-3490高 7.5RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable…