https://bugzilla.redhat.com/show_bug.cgi?id=1448753
Bug ID: 1448753 Summary: SourceProvider in RestEasy-jaxrs is vulnerable to XXE Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: jshepherd@redhat.com CC: alee@redhat.com, java-sig-commits@lists.fedoraproject.org, mgoldman@redhat.com, puntogil@libero.it, weli@redhat.com
RESTEasy SourceProvider unmarshals some content without XML External Entity protection. An attacker can use this flaw to launch an XXE attack on a RESTEasy endpoint which uses a wildcard mime-type of mulitpart mime-type. Its only possible to launch an attack if a mime-type of 'application/*+xml' is used specifically.