Improper input validation in JBoss RESTEasy - CVE-2016-9606

Vulnerability identifier: #VU6611

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9606

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.

The weakness exists due to improper parsing of user-supplied requests. A remote attacker can submit a specially crafted request, which when parsed by the YamlProvider feature of the affected application allows to execute arbitrary code with the permissions of the application using RESTEasy.

Successful exploitation of the vulnerability may result in full system compromise.

JBoss RESTEasy
JBoss Enterprise Application Platform
openEuler
resteasy
resteasy-javadoc
resteasy-client
resteasy-json-p-provider
resteasy-jaxb-provider
resteasy-core
resteasy-optional
resteasy-multipart-provider
resteasy-jackson2-provider
resteasy-netty3
resteasy-yaml-provider
resteasy-validator-provider-11
resteasy-test
resteasy-jackson-provider
resteasy-atom-provider
resteasy-jettison-provider

Update to version 3.1.2 and 3.0.22.

resteasy - update to 3.0.19-2
resteasy-javadoc - update to 3.0.19-2
resteasy-client - update to 3.0.19-2
resteasy-json-p-provider - update to 3.0.19-2
resteasy-jaxb-provider - update to 3.0.19-2
resteasy-core - update to 3.0.19-2
resteasy-optional - update to 3.0.19-2
resteasy-multipart-provider - update to 3.0.19-2
resteasy-jackson2-provider - update to 3.0.19-2
resteasy-netty3 - update to 3.0.19-2
resteasy-yaml-provider - update to 3.0.19-2
resteasy-validator-provider-11 - update to 3.0.19-2
resteasy-test - update to 3.0.19-2
resteasy-jackson-provider - update to 3.0.19-2
resteasy-atom-provider - update to 3.0.19-2
resteasy-jettison-provider - update to 3.0.19-2

• https://access.redhat.com/security/cve/CVE-2016-9606

• Remote code execution in Red Hat JBoss RESTEasy
• Red Hat update for eap7-jboss-ec2-eap
• openEuler 20.03 LTS SP1 update for resteasy