GitHub Advisoryadvisory · Maven

GHSA-63cq-ppq8-cw6g Improper Input Validation in RESTEasy

HIGH Published 2022-05-24 Modified 2022-06-24 Official page ↗
Aliases
CVE-2020-1695
Ecosystem
Maven
Packages
org.jboss.resteasy:resteasy-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-06-24

Affected packages

• Maven org.jboss.resteasy:resteasy-client: >= 4.0.0, < 4.6.0 → fixed in 4.6.0 • Maven org.jboss.resteasy:resteasy-client: >= 3.0.0, < 3.12.0 → fixed in 3.12.0

Description

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

Related

Alias · CVE (1)

  • CVE-2020-1695 A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References