Insecure Temporary File in Resteasy - CVE-2023-0482

Vulnerability identifier: #VU72075

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0482

CWE-ID: CWE-377

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to insecure creation of temporary files. A local user can gain access to sensitive information.

Resteasy
IBM Business Automation Manager Open Editions
IBM i Modernization Engine for Lifecycle Integration
PowerVM NovaLink
IBM Security Directory Suite
Storage Protect Operations Center
Storage Protect Server
Telco Service Activator
IBM Match 360
IBM SPSS Analytic Server
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Cloud Pak for Business Automation
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Tivoli Netcool Impact
IBM Cloud Application Performance Management (APM)
IBM TXSeries for Multiplatforms
Maximo Manage Application in IBM Maximo Application Suite
IBM Maximo Application Suite
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
IBM i
JBoss Enterprise Application Platform
AMQ Broker
AMQ Streams
IBM WebSphere Application Server Liberty
Red Hat Single Sign-On
eap7-jboss-el (Red Hat package)
eap7-apache-mime4j (Red Hat package)
eap7-activemq-artemis-native (Red Hat package)
eap7-artemis-native (Red Hat package)
eap7-artemis-wildfly-integration (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-undertow (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-jbossws-spi (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-jboss-metadata (Red Hat package)
rh-sso7-keycloak (Red Hat package)
IBM Cloud Pak System
IBM Security Verify Access
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Cognos Analytics

Install updates from vendor's website.

Resteasy - update to 4.7.8.Final
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - addressed in versions 7.13.4, 7.13.5
JBoss Enterprise Application Platform - update to 7.4.10
Red Hat Single Sign-On - update to 7.6.3
AMQ Broker - update to 7.10.3
IBM Business Automation Manager Open Editions - update to 8.0.3
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.20, 22.0.2.4
eap7-jboss-el (Red Hat package) - addressed in versions api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el7eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el8eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el9eap
eap7-apache-mime4j (Red Hat package) - addressed in versions 0.8.9-1.redhat_00001.1.el7eap, 0.8.9-1.redhat_00001.1.el8eap, 0.8.9-1.redhat_00001.1.el9eap
eap7-activemq-artemis-native (Red Hat package) - addressed in versions 1.0.2-3.redhat_00004.1.el7eap, 1.0.2-3.redhat_00004.1.el8eap, 1.0.2-3.redhat_00004.1.el9eap
eap7-artemis-native (Red Hat package) - addressed in versions 1.0.2-4.redhat_00004.1.el7eap, 1.0.2-4.redhat_00004.1.el8eap, 1.0.2-4.redhat_00004.1.el9eap
eap7-artemis-wildfly-integration (Red Hat package) - addressed in versions 1.0.7-1.redhat_00001.1.el7eap, 1.0.7-1.redhat_00001.1.el8eap, 1.0.7-1.redhat_00001.1.el9eap
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.16-1.Final_redhat_00002.1.el7eap, 1.1.16-1.Final_redhat_00002.1.el8eap, 1.1.16-1.Final_redhat_00002.1.el9eap
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.4
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.11-1.Final_redhat_00001.1.el7eap, 1.5.11-1.Final_redhat_00001.1.el8eap, 1.5.11-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-26.Final_redhat_00025.1.el7eap, 1.10.0-26.Final_redhat_00025.1.el8eap, 1.10.0-26.Final_redhat_00025.1.el9eap
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-2.SP1_redhat_00001.1.el7eap, 1.33.0-2.SP1_redhat_00001.1.el8eap, 1.33.0-2.SP1_redhat_00001.1.el9eap
PowerVM NovaLink - addressed in versions 2.0.1-230626, 2.0.3.1.1-230726, 2.1.1-230725
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.14-1.Final_redhat_00001.1.el7eap, 2.0.14-1.Final_redhat_00001.1.el8eap, 2.0.14-1.Final_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.23-1.SP2_redhat_00001.1.el7eap, 2.2.23-1.SP2_redhat_00001.1.el8eap, 2.2.23-1.SP2_redhat_00001.1.el9eap
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
AMQ Streams - update to 2.5.0
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-22.SP12_redhat_00012.1.el7eap, 2.5.5-22.SP12_redhat_00012.1.el8eap, 2.5.5-22.SP12_redhat_00012.1.el9eap
eap7-jbossws-spi (Red Hat package) - addressed in versions 3.4.0-2.Final_redhat_00001.1.el7eap, 3.4.0-2.Final_redhat_00001.1.el8eap, 3.4.0-2.Final_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package) - addressed in versions 3.15.5-1.Final_redhat_00001.1.el7eap, 3.15.5-1.Final_redhat_00001.1.el8eap, 3.15.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.50-1.Final_redhat_00001.1.el7eap, 4.0.50-1.Final_redhat_00001.1.el8eap, 4.0.50-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.8-1.Final_redhat_00001.1.el7eap, 5.4.8-1.Final_redhat_00001.1.el8eap, 5.4.8-1.Final_redhat_00001.1.el9eap
IBM Spectrum Control - update to 5.4.10.2
IBM Tivoli Netcool Impact - update to 7.1.0.31
eap7-wildfly (Red Hat package) - addressed in versions 7.4.10-6.GA_redhat_00002.1.el7eap, 7.4.10-6.GA_redhat_00002.1.el8eap, 7.4.10-6.GA_redhat_00002.1.el9eap
IBM Security Directory Suite - update to 8.0.1.21
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Protect Operations Center - update to 8.1.19
Storage Protect Server - update to 8.1.19
IBM TXSeries for Multiplatforms - addressed in versions 8.2.0.2, 9.1.0.2
Maximo Manage Application in IBM Maximo Application Suite - addressed in versions 8.5.6, 8.6.2
IBM Maximo Application Suite - addressed in versions 8.9.7, 8.10.2
Telco Service Activator - update to 9.1.31
IBM Security Verify Access - update to 10.0.7.0
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix16, 11.1.0.0 ifix9
eap7-infinispan (Red Hat package) - addressed in versions 11.0.17-1.Final_redhat_00001.1.el7eap, 11.0.17-1.Final_redhat_00001.1.el8eap, 11.0.17-1.Final_redhat_00001.1.el9eap
IBM CICS TX Standard - update to 11.1.0.0 ifix9
IBM Cognos Analytics - addressed in versions 11.2.4 Fix Pack 2, 12.0.1
eap7-jboss-metadata (Red Hat package) - addressed in versions 13.4.0-1.Final_redhat_00001.1.el7eap, 13.4.0-1.Final_redhat_00001.1.el8eap, 13.4.0-1.Final_redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.7-1.redhat_00001.1.el7sso, 18.0.7-1.redhat_00001.1.el8sso, 18.0.7-1.redhat_00001.1.el9sso
IBM WebSphere Application Server Liberty - update to 23.0.0.4

• https://github.com/resteasy/Resteasy/releases/tag/4.7.8.Final

• Information disclosure in Resteasy
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
• Insecure temporary file in IBM WebSphere Application Server Liberty
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM i
• Insecure temporary file in IBM CICS TX Advanced
• Insecure temporary file in IBM CICS TX Standard
• Insecure temporary file in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat AMQ Broker 7.10
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Insecure temporary file in IBM Storage Protect Operations Center
• Insecure temporary file in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Insecure temporary file in IBM Watson Assistant for IBM Cloud Pak for Data
• Insecure temporary file in IBM Match 360
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Insecure temporary file in IBM PowerVM Novalink
• Insecure temporary file in IBM Maximo Application Suite
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in IBM Cognos Analytics
• Insecure temporary file in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM Spectrum Control
• Insecure temporary file in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in Red Hat Process Automation Manager 7.13
• Multiple vulnerabilities in IBM Security Directory Suite
• IBM SPSS Analytic Server update for RESTEasy
• Multiple vulnerabilities in HPE Telco Service Activator