Information disclosure in Resteasy - CVE-2021-20289

Vulnerability identifier: #VU56965

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20289

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. A remote attacker can obtain endpoint class and method names.

Resteasy
Oracle Communications Cloud Native Core Console
JBoss Enterprise Application Platform
AMQ Broker
Red Hat Single Sign-On
openEuler
Red Hat Integration Camel-K
resteasy-jackson-provider
resteasy-optional
resteasy-jaxb-provider
resteasy-validator-provider-11
resteasy-multipart-provider
resteasy-core
resteasy-yaml-provider
resteasy-test
resteasy-jettison-provider
resteasy-jackson2-provider
resteasy-client
resteasy-atom-provider
resteasy-netty3
resteasy
resteasy-javadoc
resteasy-json-p-provider

Install updates from vendor's website.

Resteasy - update to 4.6.0.Final
JBoss Enterprise Application Platform - update to 7.4.2
Red Hat Single Sign-On - addressed in versions 7.4.10, 7.5.1
AMQ Broker - update to 7.9.0
Red Hat Integration Camel-K - update to 1.8
resteasy-jackson-provider - update to 3.0.19-3
resteasy-optional - update to 3.0.19-3
resteasy-jaxb-provider - update to 3.0.19-3
resteasy-validator-provider-11 - update to 3.0.19-3
resteasy-multipart-provider - update to 3.0.19-3
resteasy-core - update to 3.0.19-3
resteasy-yaml-provider - update to 3.0.19-3
resteasy-test - update to 3.0.19-3
resteasy-jettison-provider - update to 3.0.19-3
resteasy-jackson2-provider - update to 3.0.19-3
resteasy-client - update to 3.0.19-3
resteasy-atom-provider - update to 3.0.19-3
resteasy-netty3 - update to 3.0.19-3
resteasy - update to 3.0.19-3
resteasy-javadoc - update to 3.0.19-3
resteasy-json-p-provider - update to 3.0.19-3

• https://bugzilla.redhat.com/show_bug.cgi?id=1935927

• Information disclosire in RESTEasy
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Multiple vulnerabilities in Red Hat Single Sign-On
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Red Hat Integration Camel-K
• openEuler 20.03 LTS SP1 update for resteasy
• Multiple vulnerabilities in Red Hat Single Sign-On 7.4